CVE-2019-9886CWE-22CWE-284

eClass platform allows user to download arbitrary files without authentication

Critical · published July 11, 2019

CVSS v3.0
9.1
EPSS
2%
Percentile
82.7
In the wild
Unconfirmed
What it is

Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

The record
Technical detail
CVSS v3.0
9.1 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02245 · 82.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-284 · Improper Access Control
Published
2019-07-11T18:21Z
EPSS history
Timeline
  • 11 JUL 18:21Z
    eClass platform allows user to download arbitrary files without authentication
    cvelistv5