PT-2023-21161 · Unknown · Thmmniii/Fbs-Core

Mxsph · Published 2023-03-07 · Updated 2023-03-14 · CVE-2023-27485

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions thmmniii/fbs-core versions prior to 1.5.3

Description thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3, when querying subresults, it is possible to query subresults from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user.

Recommendations For versions prior to 1.5.3, upgrade to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the subresults query for logged-in users until the upgrade is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-27485

GHSA-FHQ8-P3W6-MMGR

Affected Products

Thmmniii/Fbs-Core

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27485.json · Exploit
• https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-mmgr · Patch
• https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb15949038473d41b1358493 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-27485 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27485 · Vendor Advisory
• https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3 · Note
• https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/getCourseTaskSubmissionSubresults · Note
• https://t.me/cibsecurity/59615 · Telegram Post
• https://t.me/cvenotify/45763 · Telegram Post