CVE-2024-12305 Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform
A malicious student can view other students' grades by manipulating the student_id parameter due to insufficient access control checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12305?
CVE-2024-12305 is a medium-severity missing authorization vulnerability in Unifiedtransform, published on 9 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available.
Weakness: CWE-639
Which versions are affected by CVE-2024-12305?
How do I fix CVE-2024-12305?
No fix has been published for CVE-2024-12305 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-12305 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12305 exists.
Sources
Also known as GHSA-3fh3-9f74-h562.