PT-2013-4507 · Trivantis · Coursemill Learning Management System

Mike Czumak · Publicado 2013-09-06 · Atualizado 2013-09-30 · CVE-2013-3601

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System (LMS) version 6.6

Description The issue allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter. This is due to the system not properly restricting JSP function calls.

Recommendations For version 6.6, restrict access to JSP function calls for users with the Student role to prevent arbitrary operations. Consider temporarily disabling the op parameter in affected JSP operations until a proper fix is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-3601

Produtos afetados

Coursemill Learning Management System

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-3601 · Nota de Segurança
• http://kb.cert.org/vuls/id/960908 · Nota