PT-2024-32832 · Markus · Markus

Published 2024-11-18 · Updated 2025-09-04 · CVE-2024-47820

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8

Description The issue affects MarkUs, a web application for the submission and grading of student assignments. It is vulnerable to path traversal, allowing authenticated instructors to download any file on the web server MarkUs is running on, depending on the file permissions.

Recommendations For versions prior to 2.4.8, upgrade to MarkUs version 2.4.8 to address the path traversal issue. At the moment, there is no information about other workarounds aside from upgrading to version 2.4.8.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-47820

GHSA-WQ6V-VX8C-8FJ8

Affected Products

Markus

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47820.json · Exploit
• https://github.com/MarkUsProject/Markus/pull/7026 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47820 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47820 · Vendor Advisory
• https://github.com/MarkUsProject/Markus/security/advisories/GHSA-wq6v-vx8c-8fj8 · Note
• https://twitter.com/CVEnew/status/1858559690872934793 · Twitter Post
• https://t.me/cveNotify/134279 · Telegram Post
• https://t.me/cvedetector/11364 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1858616593455972662 · Twitter Post