PT-2024-28056 · Unknown+1 · Open Eclass+1

John-Weasel-4345 · Published 2024-08-12 · Updated 2024-08-17 · CVE-2024-38530

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 3.16

Description The Open eClass platform, a complete Course Management System, contains an arbitrary file upload vulnerability in the "save" functionality of the H5P module. This vulnerability enables unauthenticated users to upload arbitrary files on the server's filesystem, potentially leading to unrestricted remote code execution (RCE) on the backend server, as the upload location is accessible from the internet.

Recommendations For versions prior to 3.16, update to version 3.16 to fix the arbitrary file upload vulnerability in the H5P module. As a temporary workaround, consider restricting access to the H5P module's "save" functionality to prevent unauthenticated file uploads until the update is applied.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-38530

GHSA-88C3-HP7P-GRGG

Affected Products

H5P

Open Eclass

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38530.json · Exploit
• 🔥 https://github.com/gunet/openeclass/security/advisories/GHSA-88c3-hp7p-grgg · Exploit
• https://github.com/gunet/openeclass/commit/4449cf8bed40fd8fc4b267a5726fab9f9fe5a191 · Patch
• https://osv.dev/vulnerability/CVE-2024-38530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38530 · Security Note
• https://twitter.com/VulmonFeeds/status/1823036736152236167 · Twitter Post
• https://twitter.com/CveFindCom/status/1823034509618561257 · Twitter Post
• https://t.me/cvedetector/2850 · Telegram Post
• https://twitter.com/oktsec/status/1824751567775404062 · Twitter Post
• https://twitter.com/CVEnew/status/1823015842180645288 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823016750071291980 · Twitter Post
• https://t.me/cvenotify/90381 · Telegram Post
• https://t.me/cvenotify/90122 · Telegram Post