CVE-2024-49376

HIGH EPSS 36.2%
Published Oct 25, 20241y ago · Modified Jun 17, 20262w ago
7.1 CVSS 4.0
High
Find Similar
Published Oct 25, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
36.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication
CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
autolabprojectautolab3.0.0any

References 2

  • github.com https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
    Patch
  • github.com https://github.com/autolab/Autolab/security/advisories/GHSA-v46j-h43h-rwrm
    Vendor Advisory

Remediation

  • github.com https://github.com/autolab/Autolab/commit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b
    Patch