CVE-2024-52584

Description

Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available.

Reserved 2024-11-14 | Published 2024-11-18 | Updated 2024-11-21 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

Product status

= 3.0.1
affected

References

github.com/...utolab/security/advisories/GHSA-rjg4-cf66-x6gr

github.com/...ommit/96006d532a392eeca2d350d1811f8e8ab9625bda

cve.org (CVE-2024-52584)

nvd.nist.gov (CVE-2024-52584)

Download JSON