AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Dashboard Vulnerabilities News Research Archive Stats Dataset For devs

aisecwatch.com

Real-time AI security monitoring. Tracking AI-related vulnerabilities, safety and security incidents, privacy risks, research developments, and policy changes.

Navigation

Vulnerabilities News Research Digest Archive Newsletter Archive Subscribe Data Sources Statistics Dataset API Integrations Widget RSS Feed

Maintained by

Truong (Jack) Luu

Information Systems Researcher

CVE-2024-53258: Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 o | AI Sec Watch

CVE-2024-53258: Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 o

mediumvulnerability

security

Source: NVD/CVE DatabaseNovember 25, 2024CVE-2024-53258

Summary

Autolab is a course management system that automatically grades programming assignments. A vulnerability in versions 3.0.0 and later allows any logged-in student to download all submissions from other students or even instructor test files using the download_all_submissions feature, potentially exposing private coursework to unauthorized people.

Solution / Mitigation

The issue has been patched in commit `1aa4c769`, which is expected to be included in version 3.0.3. Users can either manually patch their installation or wait for version 3.0.3 to be released. As an immediate temporary workaround, administrators can disable the download_all_submissions feature.