Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
Résumé
Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradebook scores for any course, without enrollment or supervisory relationship. This vulnerability is fixed in 2.0.0-RC.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com