Riskcovery

CVE-2024-12306

Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform

State
Published
Severity
4.3 Medium
Published
Dec 9, 2024
Updated
Dec 9, 2024
Reserved
Dec 6, 2024

Read the record on cve.org

Description

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NNCSC.ch

Weaknesses

  • CWE-284 Improper Access Control
  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
UnifiedtransformUnifiedtransform
  • 2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.