CVE-2023-44395mediumCWE-22

CVE-2023-44395: fallo de gravedad media en Autolab

Autolab has Path Traversal vulnerability in Assessment functionality

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Autolab

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.9epss 0.6%
Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Productos afectados
autolab · Autolab
CVEs relacionadas — Autolab

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-41956MEDIUMAutolab is vulnerable to file disclosure via remote handin featureEPSS 1.8%CVE-2022-41955HIGHAutolab is vulnerable to remote code execution (RCE) via MOSS functionalityEPSS 1.6%CVE-2023-32676MEDIUMAutolab tar slip in Install Assessment functionality (`GHSL-2023-081`)EPSS 0.9%CVE-2023-32317MEDIUMAutolab tar slip in cheat checker functionality (`GHSL-2023-082`)EPSS 0.9%CVE-2024-53258HIGHdownload_all_submissions allows student to download another student's submissions in AutolabEPSS 0.5%CVE-2024-53260MEDIUMCourse Roster vulnerable to CSV Injection in AutolabEPSS 0.5%