Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
概要
Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com