CVE-2020-37114: fallo de gravedad media en Openeclass GUnet OpenEclass
GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosure
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Openeclass · GUnet OpenEclassCVEs relacionadas — Openeclass GUnet OpenEclass
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-37113HIGHGUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension BypassEPSS 0.9%CVE-2020-37116HIGHGUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote AccessEPSS 0.5%CVE-2020-37112HIGHGUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL InjectionEPSS 0.3%CVE-2020-37115HIGHGUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageEPSS 0.3%