CVE-2023-44395mediumCWE-22

CVE-2023-44395: medium-severity vulnerability in Autolab

Autolab has Path Traversal vulnerability in Assessment functionality

Published · Updated

Follow this CVE+ Monitor Autolab

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.6%
Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
autolab · Autolab
Related CVEs — Autolab

In the same product, most dangerous first.

CVE-2022-41956MEDIUMAutolab is vulnerable to file disclosure via remote handin featureEPSS 1.8%CVE-2022-41955HIGHAutolab is vulnerable to remote code execution (RCE) via MOSS functionalityEPSS 1.6%CVE-2023-32676MEDIUMAutolab tar slip in Install Assessment functionality (`GHSL-2023-081`)EPSS 0.9%CVE-2023-32317MEDIUMAutolab tar slip in cheat checker functionality (`GHSL-2023-082`)EPSS 0.9%CVE-2024-53260MEDIUMCourse Roster vulnerable to CSV Injection in AutolabEPSS 0.5%CVE-2024-53258HIGHdownload_all_submissions allows student to download another student's submissions in AutolabEPSS 0.5%