CVE-2023-32317: fallo de gravedad media en Autolab
Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.7epss 0.9%
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both "Base File Tar" and "Additional file archive" can be fed with Tar files that contain paths outside their target directories (e.g., `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process. This issue has been addressed in version 2.11.0. Users are advised to upgrade.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Productos afectados
autolab · AutolabCVEs relacionadas — Autolab
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-41956MEDIUMAutolab is vulnerable to file disclosure via remote handin featureEPSS 1.8%CVE-2022-41955HIGHAutolab is vulnerable to remote code execution (RCE) via MOSS functionalityEPSS 1.6%CVE-2023-32676MEDIUMAutolab tar slip in Install Assessment functionality (`GHSL-2023-081`)EPSS 0.9%CVE-2023-44395MEDIUMAutolab has Path Traversal vulnerability in Assessment functionalityEPSS 0.6%CVE-2024-53258HIGHdownload_all_submissions allows student to download another student's submissions in AutolabEPSS 0.5%CVE-2024-53260MEDIUMCourse Roster vulnerable to CSV Injection in AutolabEPSS 0.5%