6.8 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:S/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
28.5%
DISPUTED Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that “This is a customer specific issue related to their Kerberos authentication single sign-on application and not a vulnerability in the Blackboard product.”
CPE | Name | Operator | Version |
---|---|---|---|
blackboard | eq | 5.0.2 | |
blackboard | eq | 6.0 | |
blackboard | eq | 5.5 | |
blackboard | eq | 5.5.1 | |
blackboard | eq | 5.0 | |
blackboard_academic_suite | eq | 6.0 |