CVE-2024-12307 MEDIUM

CVE-2024-12307: Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform

Vendor Unifiedtransform
Product Unifiedtransform
Weakness CWE-284
Published December 9, 2024
Last update December 9, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the student editing functionality. At the time of publication of the CVE no patch is available.

Key dates

02Disclosure timeline

December 9, 2024 CVE published
December 9, 2024 Record updated