Access Control Flaws in Unifiedtransform Impacting Educational Data Security

CVE-2024-12306

Summary

CVE-2024-12306 identifies critical access control vulnerabilities present in Unifiedtransform version 2.0 and potentially in earlier iterations. These vulnerabilities enable unauthorized access to sensitive personal information of students and teachers, manifesting in two primary methods: loopholes in function-level access control on list viewing endpoints and object-level access control weaknesses on profile viewing endpoints. This could lead to malicious actors, such as students, obtaining personal data from other users. As of the latest update, no patch has been released to remediate these vulnerabilities, highlighting an urgent need for organizations using Unifiedtransform to implement immediate security measures and monitor for potential exploits.

References