Description
Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/autolab/Autolab/security/advisories/GHSA-rjg4-cf66-x6gr
Scores
CVSS v3
5.4
EPSS
0.0033
EPSS Percentile
55.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (1)
autolabproject/autolab
3.0.1
Published
Nov 18, 2024
Tracked Since
Feb 18, 2026