Missing Authorization Vulnerability Affects Academy LMS
CVE-2024-33912

8.8HIGH

Key Information:

Vendor

WordPress
Status
Academy Lms
Vendor
CVE Published:
6 May 2024

What is CVE-2024-33912?

Academy LMS has been identified with a missing authorization vulnerability that affects access control mechanisms, allowing unauthorized users to gain access to restricted features within the LMS platform. This vulnerability, present in versions from n/a through 1.9.16, can potentially expose sensitive information and functionalities, posing significant risks for users depending on this learning management system. The incident highlights the necessity for stringent access controls and appropriate authentication measures to safeguard user data and maintain system integrity.

Affected Version(s)

Academy LMS <= 1.9.16

References

https://patchstack.com/database/vulnerability/academy/wor...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Steven Julian (Patchstack Alliance)
.