Back to Database
Status published
High
CVE-2024-49376
Autolab Has Misconfigured Reset Password Permissions
Vulnerability Description
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-49376
Credits & Attribution
No credits recorded in the NVD database.
References
More from autolab
View All →CVE-2024-53260
Course Roster vulnerable to CSV Injection in Autolab
Medium
6.8
CVE-2024-53258
download_all_submissions allows student to download another student's submissions in Autolab
High
7.1
CVE-2024-52585
Autolab has HTML Injection Vulnerability
Low
1.2
CVE-2024-52584
Autolab has vulnerable submission endpoints
Medium
4.9
CVE-2023-44395
Autolab has Path Traversal vulnerability in Assessment functionality
Medium
4.9
Affected Vendor
autolab
View all reports →Affected Software
Autolab
Vulnerable Versions:
= 3.0.0
Timeline
Official Publish:
October 25th, 2024
Last Modified:
October 25th, 2024
Added to House:
July 22nd, 2026