CVE-2023-44395 Autolab has Path Traversal vulnerability in Assessment functionality

What is CVE-2023-44395?

CVE-2023-44395 is a medium-severity vulnerability in Autolab, published on 22 Jan 2024.

Official description

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform arbitrary file reads. Version 2.12.0 contains a patch. There are no feasible workarounds for this issue.

Weakness: CWE-22

Which versions are affected by CVE-2023-44395?

It affects 1 product.

Products include Autolabproject Autolab.

How do I fix CVE-2023-44395?

No fix has been published for CVE-2023-44395 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-44395 being exploited?

There is no known exploitation of CVE-2023-44395 in the wild and no public exploit code.

Other vulnerabilities in Autolab

• CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality High 8.8
• CVE-2022-0936 Cross-site Scripting (XSS) - Stored in autolab/autolab High 7.6
• CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab High 7.1
• CVE-2024-49376 Autolab Has Misconfigured Reset Password Permissions High 7.1
• CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h8wq-ghfq-5hfx.