CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
Explanation of Vulnerability in Simple Terms
Academy LMS versions up to 3.3.4 contain an authorization flaw that allows high-privilege users to trigger a denial-of-service condition affecting site availability. The vulnerability requires administrative or elevated account access and does not involve user interaction. A low-level information disclosure may also occur. Update to a version newer than 3.3.4.
What an attacker can do
Trigger a denial-of-service condition and read limited sensitive information.
Potential impact on your site
Site availability may be disrupted by a privileged user; some data may be exposed.
Conditions required to exploit
Attacker must have high-privilege account access (admin or equivalent role).
Key dates
External resources
Related vulnerabilities
