PT-2008-4824 · Blackboard · Blackboard Academic Suite

Published 2008-07-31 · Updated 2024-02-14 · CVE-2008-3421

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Blackboard Academic Suite version 8.0.260.7

Description The issue affects the authentication of student users, allowing remote attackers to hijack it for requests that change configuration and enrollments. This is achieved through unspecified input to API endpoints such as "update module.jsp", "enroll course.pl", and "unenroll.jsp".

Recommendations For Blackboard Academic Suite version 8.0.260.7, consider restricting access to the update module.jsp, enroll course.pl, and unenroll.jsp endpoints until a patch is available. As a temporary workaround, restrict the ability to change configuration and enrollments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-3421

Affected Products

Blackboard Academic Suite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-3421 · Security Note
• http://secunia.com/advisories/31177 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43986 · Note
• http://securitytracker.com/id?1020559 · Note
• http://ceaseless.ws/bb-csrf · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3421 · Note