CVE-2024-49376

Katalog CVE

CVSS 8.8 · High EPSS 0,47%

Kerentanan Improper Authentication pada autolabproject autolab. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.

Rincian

Terbit di NVD

25 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm advisory vendor
• https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b patch