PT-2024-13730 · Ellucian · Ellucian Banner

Abdulaziz Naif Almadhi · Published 2024-02-12 · Updated 2024-10-10 · CVE-2023-49339

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ellucian Banner version 9.17

Description The issue allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the "/StudentSelfService/ssb/studentCard/retrieveData" endpoint. This means an attacker could potentially access sensitive information by manipulating the bannerId parameter in the request to the specified endpoint.

Recommendations For Ellucian Banner version 9.17, consider restricting access to the "/StudentSelfService/ssb/studentCard/retrieveData" endpoint until a patch is available. As a temporary workaround, avoid using the modified bannerId parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-49339

Affected Products

Ellucian Banner

References · 8

• 🔥 https://github.com/3zizme/CVE-2023-49339 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49339 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49339 · Vendor Advisory
• https://t.me/cvenotify/71172 · Telegram Post
• https://t.me/cvenotify/97774 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757300774365696288 · Twitter Post
• https://twitter.com/CVEnew/status/1757222735833338173 · Twitter Post
• https://ellucian.com/solutions/ellucian-banner · Note