CVE-2024-12306

CVSS V2 None CVSS V3 None

Description

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available.

Overview

CVE ID
CVE-2024-12306

Assigner
NCSC.ch

Vulnerability Status
PUBLISHED

Published Version
2024-12-09T08:50:23.241Z

Last Modified Date
2024-12-09T15:27:21.662Z

Weakness Enumerations

CWE	URL
CWE-284	http://cwe.mitre.org/data/definitions/284.html
CWE-639	http://cwe.mitre.org/data/definitions/639.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c	exploit

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-12306
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12306

History

Created	Old Value	New Value	Data Type	Notes
2024-12-10 13:51:23				Added to TrackCVE