CVE-2024-53258

HIGH EPSS 37.1%
Published Nov 25, 20241y ago · Modified Jun 17, 20262w ago
7.1 CVSS 4.0
High
Find Similar
Published Nov 25, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
37.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-359
CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
autolabprojectautolab*≥3.0.0  –  ≤3.0.2

References 2

  • github.com https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d
    Patch
  • github.com https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3
    Vendor Advisory

Remediation

  • github.com https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d
    Patch