CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
Explanation of Vulnerability in Simple Terms
Tutor LMS versions up to 3.9.4 contain an authorization flaw that allows authenticated users to read sensitive data they should not access. An attacker with a low-privilege account can retrieve confidential information through the application without modifying or disrupting service. The vulnerability requires network access and valid login credentials.
What an attacker can do
Read sensitive data belonging to other users or the site.
Potential impact on your site
Student or instructor accounts can view confidential information they shouldn't access.
Conditions required to exploit
Attacker must have a valid low-privilege account and network access to the site.
Key dates
External resources
Related vulnerabilities
