CVE-2024-11716 Business logic in CTFd
Authenticated users can improperly switch teams during an ongoing competition, violating assignment rules and compromising competition integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11716?
CVE-2024-11716 is a medium-severity vulnerability in CTFd, published on 2 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636 included in 3.7.5 release.
Weakness: CWE-837
Which versions are affected by CVE-2024-11716?
How do I fix CVE-2024-11716?
No fix has been published for CVE-2024-11716 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-11716 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11716 exists.
Sources
Also known as GHSA-7wpf-4jwj-r2v3.