CVE-2024-13110mediumCWE-200CWE-284

CVE-2024-13110: medium-severity vulnerability in Beijing Yunfan Internet Technology Yunfan…

Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure

Published

Follow this CVE+ Monitor Yunfan Learning Examination System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Beijing Yunfan Internet Technology · Yunfan Learning Examination System
Related CVEs — Beijing Yunfan Internet Technology Yunfan…

In the same product, most dangerous first.

CVE-2024-13111MEDIUMBeijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authenticationEPSS 0.8%CVE-2024-13109MEDIUMBeijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorizationEPSS 0.6%