Chamilo LMS before version 2.0.0-RC.3 has a missing authentication vulnerability (CWE-306) in the PENS plugin endpoint at public/plugin/Pens/pens.php. This endpoint accepts a user-supplied package-url parameter and fetches it using curl without filtering private or internal IP addresses, leading to unauthenticated Server-Side Request Forgery (CWE-918). Exploitation allows attackers to access internal network resources, cloud metadata services such as 169.254.169.254 to steal IAM credentials, and potentially trigger state-changing operations via callback parameters. No authentication is required, significantly increasing the attack surface. The vulnerability is addressed in version 2.0.0-RC.3.

An attacker can exploit this vulnerability to perform SSRF attacks without authentication, enabling reconnaissance and access to sensitive internal network services and cloud metadata endpoints. This can lead to credential theft and unauthorized state changes on internal services. The CVSS score of 8.6 reflects a high severity due to network attack vector, no privileges or user interaction required, and high confidentiality impact. There is no indication of known exploits in the wild at this time.

This vulnerability is fixed in Chamilo LMS version 2.0.0-RC.3. Users should upgrade to this version or later to remediate the issue. Patch status is not explicitly confirmed beyond this fix version, so verify with the vendor advisory for the latest remediation guidance. Until patched, restrict access to the vulnerable endpoint and monitor for suspicious requests if possible.