CVE-2024-12305CWE-639

Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform

Medium · published December 9, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-12-09T08:49Z
EPSS history
Timeline
  • 09 DEC 08:49Z
    Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform
    cvelistv5