We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available.
Reserved 2024-11-14 | Published 2024-11-18 | Updated 2024-11-21 | Assigner GitHub_MCWE-863: Incorrect Authorization
github.com/...utolab/security/advisories/GHSA-rjg4-cf66-x6gr
github.com/...ommit/96006d532a392eeca2d350d1811f8e8ab9625bda
Support options