CVE-2024-53258

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d	Patch
https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:*

History

07 Apr 2025, 19:56

Type	Values Removed	Values Added
CPE		cpe:2.3:a:autolabproject:autolab::::::::
References	~~() https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d -~~	() https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d - Patch
References	~~() https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3 -~~	() https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
First Time		Autolabproject Autolabproject autolab

Information

Published : 2024-11-25 20:15

Updated : 2025-04-07 19:56

NVD link : CVE-2024-53258

Mitre link : CVE-2024-53258

CVE.ORG link : CVE-2024-53258

JSON object : View

Products Affected

autolabproject

autolab

CWE

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2024-53258", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-11-25T20:15:10.030", "references": [{"url": "https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-359"}, {"lang": "en", "value": "CWE-862"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature."}, {"lang": "es", "value": "Autolab es un servicio de gesti\u00f3n de cursos que permite la calificaci\u00f3n autom\u00e1tica de tareas de programaci\u00f3n. A partir de la versi\u00f3n 3.0.0 de Autolab, los estudiantes pueden descargar todas las tareas de otro estudiante, siempre que hayan iniciado sesi\u00f3n, mediante la funci\u00f3n download_all_submissions. Esto puede permitir la filtraci\u00f3n de entregas a usuarios no autorizados, como la descarga de entregas de otros estudiantes de la clase o incluso entregas de ex\u00e1menes de instructores, siempre que conozcan sus ID de usuario. Este problema se ha corregido en el commit `1aa4c769`, que a\u00fan no est\u00e1 en una versi\u00f3n de lanzamiento, pero se espera que se incluya en la versi\u00f3n 3.0.3. Se recomienda a los usuarios que apliquen el parche manualmente o que esperen a la versi\u00f3n 3.0.3. Como workaround, los administradores pueden desactivar la funci\u00f3n."}], "lastModified": "2025-04-07T19:56:52.350", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4A5120A-AE4E-4B4B-8306-9FD09378AD8C", "versionEndIncluding": "3.0.2", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}