CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Explanation of Vulnerability in Simple Terms
MasterStudy LMS versions up to 3.6.20 contain a race condition that allows authenticated users to modify data they should not have access to. An attacker with low-level account privileges can exploit a timing window to alter records. The vulnerability requires network access and an active login but no user interaction beyond the attack itself.
What an attacker can do
Modify data or records in the LMS that should be restricted to their privilege level.
Potential impact on your site
Authenticated users can alter course data, grades, or other LMS records outside their intended permissions.
Conditions required to exploit
Attacker must have a valid low-privilege account and network access to the LMS.
Key dates
External resources
Related vulnerabilities
