Vulnerability · Published Nov 13, 2024 · Assigned by VulDB

CVE-2024-8001VIWIS LMS Print authorization

Medium 5.3

In plain English

A medium-severity missing authorization in LMS from VIWIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 44.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative print function with an active session before and after an exam slot to access the entire exam including solutions in the web application. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
VIWIS	LMS	9.11

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-284352 | VIWIS LMS Print authorization vdb-entry
VDB-284352 | CTI Indicators (IOB, IOC) signature, permissions-required
https://www.scip.ch/?news.20241203 related