CVE-2024-8001 MEDIUM

CVE-2024-8001: VIWIS LMS Print authorization

Vendor Viwis

Product LMS

Weakness CWE-862 · Missing authorization

Published November 13, 2024

Last update January 9, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative print function with an active session before and after an exam slot to access the entire exam including solutions in the web application. It is recommended to apply a patch to fix this issue.

Key dates

02Disclosure timeline

November 13, 2024 CVE published

January 9, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-8001 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2026-3649 Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action CVE-2026-32385 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability CVE-2025-58600 WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability CVE-2025-58680 WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability CVE-2026-24951 WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability