CVE-2022-41955

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-41955", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-09-30T16:38:28.945Z", "datePublished": "2023-01-14T00:09:07.032Z", "dateUpdated": "2024-08-03T12:56:38.649Z"}, "containers": {"cna": {"title": "Autolab is vulnerable to remote code execution (RCE) via MOSS functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269"}, {"name": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/", "tags": ["x_refsource_MISC"], "url": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/"}], "affected": [{"vendor": "autolab", "product": "Autolab", "versions": [{"version": ">= 2.0.1, <= 2.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-11T18:24:33.078Z"}, "descriptions": [{"lang": "en", "value": "Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: \"Feature disabled\", status: :bad_request) && return`."}], "source": {"advisory": "GHSA-x5r3-vf3p-3269", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:56:38.649Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269"}, {"name": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/"}]}]}}

{}

{"affected": [{"affectedData": [{"product": "Autolab", "vendor": "autolab", "versions": [{"status": "affected", "version": ">= 2.0.1, <= 2.9.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:*", "matchCriteriaId": "09725D4C-83C4-4861-B0EB-58FC9C8F665D", "versionEndExcluding": "2.10.0", "versionStartIncluding": "2.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: \"Feature disabled\", status: :bad_request) && return`."}, {"lang": "es", "value": "Autolab es un servicio de gesti\u00f3n de cursos, desarrollado inicialmente por un equipo de estudiantes de la Universidad Carnegie Mellon, que permite a los instructores ofrecer tareas de programaci\u00f3n autocalificadas a sus estudiantes a trav\u00e9s de la Web. Se descubri\u00f3 una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en la funcionalidad MOSS de Autolab, mediante la cual un instructor con acceso a la funci\u00f3n podr\u00eda ejecutar c\u00f3digo en el servidor que aloja Autolab. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 2.10.0. Como workaround, deshabilite la funci\u00f3n MOSS si no es necesaria reemplazando el cuerpo de `run_moss` en `app/controllers/courses_controller.rb` with `render(plain: \"Feature disabled\", status: :bad_request) &amp;&amp; return`."}], "id": "CVE-2022-41955", "lastModified": "2026-06-17T05:04:07.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-14T01:15:12.743", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269"}, {"source": "security-advisories@github.com", "url": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}