Chamilo LMS, an open-source learning management system, versions >=2.0.0 and <2.0.1 improperly neutralize input during web page generation, specifically in the handling of private message content. The system stores Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/view_message.html.twig. An authenticated low-privilege user can send crafted messages to an administrator, which execute in the administrator's browser upon viewing, without requiring any link interaction. This cross-site scripting vulnerability (CWE-79) can expose session credentials and allow actions to be performed as the administrator. The issue is resolved in version 2.0.1.

An attacker with low privileges (e.g., a student) can exploit this vulnerability to execute arbitrary HTML/JavaScript in the context of an administrator's browser. This can lead to session credential theft and unauthorized administrative actions, resulting in full compromise of the administrator's account and potentially the LMS environment. The CVSS 3.1 score is 9.0 (critical), reflecting high impact on confidentiality, integrity, and availability.

Upgrade Chamilo LMS to version 2.0.1 or later, where this vulnerability is fixed. No other mitigations are indicated or necessary as the fix addresses the root cause by implementing proper server-side sanitization of message content.