VulnerabilityDeferred

CVE-2024-12305

An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades.

MEDIUM 4.3EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: vulnerability@ncsc.ch

References

https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.