PT-2024-32866 · Sakai · Sakai

Published 2024-10-15 · Updated 2025-10-30 · CVE-2024-47876

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sakai versions 23.0 through 23.2

Description The issue allows kernel users created with type roleview to log in as a normal user, resulting in illegal access being granted to the system. This can pose security risks.

Recommendations For Sakai versions 23.0 through 23.2, update to version 23.3 to fix this issue. As a temporary workaround, consider restricting access to kernel users created with type roleview until the update is applied.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2024-47876

GHSA-CX95-Q6GX-W4QP

Affected Products

Sakai

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47876.json · Exploit
• https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp · Vendor Advisory
• https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47876 · Security Note
• https://osv.dev/vulnerability/GHSA-cx95-q6gx-w4qp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47876 · Vendor Advisory
• https://github.com/sakaiproject/sakai · Note
• https://twitter.com/VulmonFeeds/status/1846273330258542826 · Twitter Post
• https://sakaiproject.atlassian.net/browse/SAK-50571 · Note
• https://twitter.com/CveFindCom/status/1846219890107056592 · Twitter Post
• https://central.sonatype.com/artifact/org.sakaiproject.kernel/sakai-kernel-impl · Note
• https://t.me/cvedetector/7932 · Telegram Post
• https://t.me/cveNotify/141015 · Telegram Post
• https://twitter.com/CVEnew/status/1846224535319871855 · Twitter Post