GitHub Advisoryadvisory · RubyGems

GHSA-v46j-h43h-rwrm Autolab Misconfigured Reset Password Permissions

HIGH Published 2024-10-25 Modified 2024-11-15 Official page ↗
Aliases
CVE-2024-49376
Ecosystem
RubyGems
Packages
Autolab
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-863
Reviewed
2024-10-25

Affected packages

• RubyGems Autolab: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. Patches This is fixed in v3.0.1. Workarounds No workarounds. For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/autolab/Autolab/ Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2024-49376 Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-863 Incorrect Authorization weakness

References