CVE-2024-47820

MEDIUM

5.7

Description

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.

Details CVE

Score CVSS v3.15.7

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

Vecteur d'attaqueADJACENT_NETWORK

ComplexiteLOW

Privileges requisHIGH

Interaction utilisateurNONE

Publie11/18/2024

Derniere modification9/4/2025

Sourcenvd

Observations honeypot0

Produits affectes

markusproject:markus

Faiblesses (CWE)

CWE-22

References

https://github.com/MarkUsProject/Markus/pull/7026(security-advisories@github.com)

https://github.com/MarkUsProject/Markus/security/advisories/GHSA-wq6v-vx8c-8fj8(security-advisories@github.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.