Lucene search

MitreCVE-2024-27711

HistoryJul 05, 2024 - 5:15 p.m.

CVE-2024-27711

2024-07-0517:15:11

CWE-269

mitre

web.nvd.nist.gov

eskooly

online school

privilege escalation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up process function in the account settings.

Affected configurations

Nvd

Node

eskoolyeskoolyRange≤3.0

VendorProductVersionCPE
eskoolyeskooly*cpe:2.3:a:eskooly:eskooly:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eskooly	eskooly	*	cpe:2.3:a:eskooly:eskooly::::::::

References

blog.be-hacktive.com/eskooly-cve/eskooly-broken-authentication/cve-2024-27711-user-enumeration-via-sign-up-process-in-eskooly-web-product-less-than-v3.0

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2024-27711