CVE-2023-24834: WisdomGarden Tronclass ilearn - Broken Access Control
WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-24834.
What is the severity of CVE-2023-24834?
The severity of CVE-2023-24834 is medium with a severity value of 6.5.
How does CVE-2023-24834 impact WisdomGarden Tronclass?
CVE-2023-24834 allows an authenticated remote attacker with general user privilege to access files belonging to other users by modifying the file ID within the URL in WisdomGarden Tronclass.
Which versions of WisdomGarden Tronclass are affected by CVE-2023-24834?
Versions up to but not including 1.52.29198 of WisdomGarden Tronclass Ilearn for web, version 2.3.2 of WisdomGarden Tronclass Ilearn for Android, and version 2.3.2 of WisdomGarden Tronclass Ilearn for iPhone OS are affected by CVE-2023-24834.
Is there any fix available for CVE-2023-24834?
To mitigate the vulnerability, users are advised to update WisdomGarden Tronclass to a version that includes a fix for CVE-2023-24834.