VulnerabilityModified
CVE-2014-9753
confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
CRITICAL 9.8EPSS 2.91%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.91% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- atutor/atutor
- Source
- cve@mitre.org
References
- http://karmainsecurity.com/KIS-2015-06Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Nov/11Exploit, Mailing List, Third Party Advisory
- http://update.atutor.ca/patch/2_2/2_2-6/patch.xmlBroken Link
- http://www.securityfocus.com/archive/1/archive/1/536835/100/0/threadedBroken Link
- https://github.com/atutor/ATutor/commit/950a0299954e69b8742cc1f1a632f564435d4d7dPatch, Third Party Advisory
- http://karmainsecurity.com/KIS-2015-06Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Nov/11Exploit, Mailing List, Third Party Advisory
- http://update.atutor.ca/patch/2_2/2_2-6/patch.xmlBroken Link
- http://www.securityfocus.com/archive/1/archive/1/536835/100/0/threadedBroken Link
- https://github.com/atutor/ATutor/commit/950a0299954e69b8742cc1f1a632f564435d4d7dPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.