CVE-2023-32676

Katalog CVE

CVSS 7.2 · High EPSS 0,91%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada autolabproject autolab. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g., `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.

Rincian

Terbit di NVD

26 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/autolab/Autolab/security/advisories/GHSA-x9hj-r9q4-832c advisory vendor
• https://github.com/autolab/Autolab/commit/14f508484a8323eceb0cf3a128573b43eabbc80d patch
• https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/