CVE-2024-12307

CVSS V2 None CVSS V3 None

Description

A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify student personal data without proper authorization. The vulnerability exists due to missing access control checks in the student editing functionality. At the time of publication of the CVE no patch is available.

Overview

CVE ID
CVE-2024-12307

Assigner
NCSC.ch

Vulnerability Status
PUBLISHED

Published Version
2024-12-09T08:50:45.498Z

Last Modified Date
2024-12-09T15:28:13.019Z

Weakness Enumerations

CWE	URL
CWE-284	http://cwe.mitre.org/data/definitions/284.html

References

Reference URL	Reference Tags
https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c	exploit

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-12307
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12307

History

Created	Old Value	New Value	Data Type	Notes
2024-12-10 13:52:32				Added to TrackCVE