CVE-2023-44395 MEDIUM

CVE-2023-44395: Autolab has Path Traversal vulnerability in Assessment functionality

Vendor Autolab

Product Autolab

Weakness CWE-22 · Path traversal

Published January 22, 2024

Last update August 23, 2024

View on NVD All CVEs

CVSS base score

4.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.

Key dates

02Disclosure timeline

January 22, 2024 CVE published

August 23, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-44395 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html