PT-2024-35697 · Autolab · Autolab

20Wildmanj · Published 2024-11-25 · Updated 2024-11-25 · CVE-2024-53258

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Autolab versions 3.0.0 through 3.0.2

Description Autolab is a course management service that enables auto-graded programming assignments. The issue allows students to download all assignments from another student, as long as they are logged in, using the download all submissions feature. This can lead to leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs.

Recommendations For Autolab versions 3.0.0 through 3.0.2, users are advised to either manually patch with commit 1aa4c769 or wait for version 3.0.3. As a temporary workaround, administrators can disable the download all submissions feature to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-359

CWE-862

Related Identifiers

CVE-2024-53258

GHSA-84QC-7773-2GG3

Affected Products

Autolab

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53258.json · Exploit
• https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d · Patch
• https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53258 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53258 · Vendor Advisory
• https://twitter.com/CVEnew/status/1861131781467935052 · Twitter Post