CVE-2024-49376 | THREATINT

Description

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.

Reserved 2024-10-14 | Published 2024-10-25 | Updated 2024-10-25 | Assigner GitHub_M

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-287: Improper Authentication

Product status

= 3.0.0

affected

References

github.com/...utolab/security/advisories/GHSA-v46j-h43h-rwrm

github.com/...ommit/301689ab5c5e39d13bab47b71eaf8998d04bcc9b

cve.org (CVE-2024-49376)

nvd.nist.gov (CVE-2024-49376)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.