The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
HighVulnerability
CVE-2022-41955: Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2022-41955
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.5%
Summary
Autolab, a course management service for autograded programming assignments, contains a remote code execution flaw in its MOSS functionality. An instructor with access to that feature might be able to execute code on the server hosting Autolab.
Mitigation
This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.