Autolab 路径遍历漏洞

Autolab is a course management service. It supports automatically graded programming assignments. A security vulnerability exists in Autolab version 2.10.0 and earlier, which stems from a Tar slip vulnerability found in Autolab's Installation Evaluation feature, which can be exploited by an...

Autolab 路径遍历漏洞

Autolab is a course management service. It supports automatically graded programming assignments. A security vulnerability exists in Autolab 2.10.0 and earlier versions, which stems from a Tar slip vulnerability found in Autolab's MOSS feature that can be exploited by an attacker to upload...

Autolab path traversal vulnerability

Autolab is a course management service. Autolab supports automatic grading of programming assignments. a path traversal vulnerability exists in Autolab. An attacker could exploit this vulnerability to view the contents of a file...

Autolab OS Command Injection Vulnerability

Autolab is a course management service. Autolab supports automated grading of programming assignments. an operating system command injection vulnerability exists in Autolab. An attacker could exploit this vulnerability to execute code on the hosted Autolab server...

CVE-2022-41956

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature,...

CVE-2022-41955

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionalit...

Remote code execution

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionalit...

Design/Logic Flaw

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature,...

CVE-2022-41956

CVE-2022-41956 affects Autolab (course management system). A file disclosure vulnerability existed in the remote handin feature, allowing an attacker to submit using paths outside the submission directory and view submitted files. The issue was fixed in version 2.10.0. Workarounds included: clear...

CVE-2022-41956 Autolab is vulnerable to file disclosure via remote handin feature

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature,...

CVE-2022-41956 Autolab is vulnerable to file disclosure via remote handin feature

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature,...

CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionalit...

CVE-2022-41955

CVE-2022-41955 affects Autolab and specifically its MOSS functionality. A remote code execution vulnerability exists whereby an instructor with access to MOSS could execute code on the server hosting Autolab. The issue has been patched in version 2.10.0. As a workaround, the recommended mitigatio...

CVE-2022-41955 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionalit...

Autolab 路径遍历漏洞

Autolab is a course management service. Autolab supports automatic grading of programming assignments. a path traversal vulnerability exists in Autolab. An attacker could exploit this vulnerability to view the contents of a file...

PT-2023-14047 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab versions prior to 2.10.0 Description: A remote code execution issue was discovered in Autolab's MOSS functionality, allowing an instructor with access to the feature to potentially execute code on the server hosting Autolab...

Autolab 命令注入漏洞

Autolab is a course management service. Autolab supports automated grading of programming assignments. an operating system command injection vulnerability exists in Autolab. An attacker could exploit this vulnerability to execute code on the hosted Autolab server...

Cross Site Request Forgery at refreshing watch list for courses

Description Hi there autolab maintainers, there is a CRSF in autolab source code in refreshing watch list due to usage of GET method. Proof of Concept 1. Install a local instance of autolab and create a course 2. Access the link /courses//metrics/refreshwatchlistinstances and see that any...

Cross site Request Forgery in running schedule by using GET method.

Description There is a CRSF in autolab source code in running scheduler due to usage of GET method. Proof of Concept 1. Install a local instance of autolab 2. Go to /courses//schedulers and create a schedule 3. Access the link courses//schedulers//run and see that the schedulers is running...

Stored XSS in application name.

Description Hi there, there is a stored XSS in Oauth application name. Proof of Concept 1. Install a local instance of Autolab. 2. Go to /oauth/applications and create a new application with name . 3. Click on Authorize and see that a pop up appears with user's cookies. Link to POC...