CVE-2024-8001

Katalog CVE

CVSS 4.3 · Medium EPSS 0,75%

Kerentanan Missing Authorization pada viwis learning management system. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative print function with an active session before and after an exam slot to access the entire exam including solutions in the web application. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

13 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.284352 advisory pihak ketiga
• https://vuldb.com/?ctiid.284352 permissions required
• https://www.scip.ch/?news.20241203