CVE-2024-47876

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47876", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-10-04T16:00:09.630Z", "datePublished": "2024-10-15T15:49:05.040Z", "dateUpdated": "2024-11-21T16:53:20.053Z"}, "containers": {"cna": {"title": "Sakai: Kernel users created with type roleview can login as a normal user", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp"}, {"name": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41", "tags": ["x_refsource_MISC"], "url": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41"}, {"name": "https://sakaiproject.atlassian.net/browse/SAK-50571", "tags": ["x_refsource_MISC"], "url": "https://sakaiproject.atlassian.net/browse/SAK-50571"}], "affected": [{"vendor": "sakaiproject", "product": "sakai", "versions": [{"version": ">= 23.0, < 23.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-15T15:49:05.040Z"}, "descriptions": [{"lang": "en", "value": "Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability."}], "source": {"advisory": "GHSA-cx95-q6gx-w4qp", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "sakaiproject", "product": "sakai", "cpes": ["cpe:2.3:a:sakaiproject:sakai:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "23.0", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "23.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T16:18:04.666121Z", "id": "CVE-2024-47876", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-21T16:53:20.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47876", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T16:18:04.666121Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sakaiproject:sakai:*:*:*:*:*:*:*:*"], "vendor": "sakaiproject", "product": "sakai", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "23.0"}, {"status": "affected", "version": "0", "lessThan": "23.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T16:17:58.796Z"}}], "cna": {"title": "Sakai: Kernel users created with type roleview can login as a normal user", "source": {"advisory": "GHSA-cx95-q6gx-w4qp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "sakaiproject", "product": "sakai", "versions": [{"status": "affected", "version": ">= 23.0, < 23.3"}]}], "references": [{"url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp", "name": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41", "name": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41", "tags": ["x_refsource_MISC"]}, {"url": "https://sakaiproject.atlassian.net/browse/SAK-50571", "name": "https://sakaiproject.atlassian.net/browse/SAK-50571", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-15T15:49:05.040Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47876", "state": "PUBLISHED", "dateUpdated": "2024-11-21T16:53:20.053Z", "dateReserved": "2024-10-04T16:00:09.630Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-10-15T15:49:05.040Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sakai", "vendor": "sakaiproject", "versions": [{"status": "affected", "version": ">= 23.0, < 23.3"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:sakaiproject:sakai:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "sakai", "vendor": "sakaiproject", "versions": [{"lessThanOrEqual": "23.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "23.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sakailms:sakai:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B20D85D-B32F-4D55-B5E5-A2050F9C60F0", "versionEndExcluding": "23.2", "versionStartIncluding": "23.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability."}, {"lang": "es", "value": "Sakai es un entorno de colaboraci\u00f3n y aprendizaje. A partir de la versi\u00f3n 23.0 y antes de la versi\u00f3n 23.2, los usuarios del kernel creados con el tipo roleview pueden iniciar sesi\u00f3n como usuarios normales. Esto puede provocar que se conceda acceso ilegal al sistema. La versi\u00f3n 23.3 corrige esta vulnerabilidad."}], "id": "CVE-2024-47876", "lastModified": "2026-06-17T07:57:54.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47876", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T16:18:04.666121Z", "version": "2.0.3"}}]}, "published": "2024-10-15T16:15:05.420", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://sakaiproject.atlassian.net/browse/SAK-50571"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}