CVE-2020-37114
GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 3, 2026
- Updated
- Jul 28, 2026
- Reserved
- Feb 3, 2026
Description
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
GUnet OpenEclassOpeneclass |
|
References
- ExploitDB-48163exploit
- Official Vendor Homepageproduct
- Changelogproduct
- VulnCheck Advisory: GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.