CVE-2023-44395CWE-22

Autolab has Path Traversal vulnerability in Assessment functionality

Medium · published January 22, 2024

CVSS v3.1
4.9
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00605 · 48.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-01-22T14:51Z
EPSS history
Timeline
  • 22 JAN 14:51Z
    Autolab has Path Traversal vulnerability in Assessment functionality
    cvelistv5