CVE-2019-9886 eClass platform allows user to download arbitrary files without authentication

Critical 9.1 Published 11 Jul 2019 Updated 16 Sep 2024

Unauthenticated attackers can download arbitrary files from the eClass platform via path traversal in the attachment download script.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-9886?

CVE-2019-9886 is a critical path traversal vulnerability in BroadLearning eclass, published on 11 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1.

Weakness: CWE-284, CWE-22

Which versions are affected by CVE-2019-9886?

It affects 1 product.

Products include Eclass Eclass Ip.

How do I fix CVE-2019-9886?

No fix has been published for CVE-2019-9886 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-9886 being exploited?

There is no known exploitation of CVE-2019-9886 in the wild and no public exploit code.

Sources

Also known as GHSA-33jr-73hp-7wxc.