CVE-2023-44395

MEDIUM

Autolab < 2.12.0 - Path Traversal in Assessment Functionality

Title source: llm

Description

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/autolab/Autolab/security/advisories/GHSA-h8wq-ghfq-5hfx

Release Notes x_refsource_misc

https://github.com/autolab/Autolab/releases/tag/v2.12.0

Technical Description x_refsource_misc

https://www.stackhawk.com/blog/rails-path-traversal-guide-examples-and-prevention/

Scores

CVSS v3 4.9

EPSS 0.0060

EPSS Percentile 44.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

autolabproject/autolab < 2.12.0

Published Jan 22, 2024

Tracked Since Feb 18, 2026