CVE-2023-44395mediumCWE-22

CVE-2023-44395: falha de média gravidade em Autolab

Autolab has Path Traversal vulnerability in Assessment functionality

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Autolab

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.9epss 0.6%
Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
autolab · Autolab
CVEs relacionadas — Autolab

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41956MEDIUMAutolab is vulnerable to file disclosure via remote handin featureEPSS 1.8%CVE-2022-41955HIGHAutolab is vulnerable to remote code execution (RCE) via MOSS functionalityEPSS 1.6%CVE-2023-32676MEDIUMAutolab tar slip in Install Assessment functionality (`GHSL-2023-081`)EPSS 0.9%CVE-2023-32317MEDIUMAutolab tar slip in cheat checker functionality (`GHSL-2023-082`)EPSS 0.9%CVE-2024-53260MEDIUMCourse Roster vulnerable to CSV Injection in AutolabEPSS 0.5%CVE-2024-53258HIGHdownload_all_submissions allows student to download another student's submissions in AutolabEPSS 0.5%