PT-2024-38746 · Viwis Lms · Viwis Lms

Ralph Meier · Published 2024-11-13 · Updated 2025-01-08 · CVE-2024-8001

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: VIWIS LMS version 9.11

Description: A critical issue was found in the Print Handler component, leading to missing authorization. This allows a user with the role learner to access the entire exam, including solutions, in the web application using the administrative print function with an active session before and after an exam slot. The attack can be launched remotely.

Recommendations: For VIWIS LMS version 9.11, apply a patch to fix this issue. As a temporary workaround, consider restricting access to the administrative print function for users with the learner role until a patch is available.

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2024-8001

Affected Products

Viwis Lms

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-8001 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8001 · Vendor Advisory
• https://vuldb.com/?ctiid.284352 · Note
• https://t.me/cvenotify/101519 · Telegram Post
• https://vuldb.com/?id.284352 · Note
• https://scip.ch/?news.20241203 · Note
• https://twitter.com/VulmonFeeds/status/1856708304912732609 · Twitter Post
• https://t.me/cvedetector/10814 · Telegram Post
• https://t.me/cvenotify/106721 · Telegram Post
• https://twitter.com/CVEnew/status/1856694169894563871 · Twitter Post