CVE-2023-38880
First published: Mon Nov 20 2023(Updated: )
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup<date>.sql" (e.g. "opensisBackup07-20-2023.sql"), i.e. can easily be guessed. This file can be accessed by any unauthenticated actor and contains a dump of the whole database including password hashes.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OS4Ed OpenSIS | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-38880?
CVE-2023-38880 is a critical vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic, which allows unauthorized access to the database backups.
How does CVE-2023-38880 impact OS4ED's openSIS Classic?
CVE-2023-38880 allows an admin to generate a database backup, which is stored in the web root, posing a risk of unauthorized access to sensitive data.
What is the severity level of CVE-2023-38880?
CVE-2023-38880 has a severity level of 9.8 (critical).
How can I fix the CVE-2023-38880 vulnerability?
To fix CVE-2023-38880, OS4ED's openSIS Classic version 9.0 users should apply the latest patch or upgrade to a version that has addressed the vulnerability.
Where can I find more information about CVE-2023-38880?
You can find more information about CVE-2023-38880 on the OS4ED GitHub repository, OS4ED's official website, and the vulnerability researcher's GitHub repository.
- collector/nvd-api
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/references
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/os4ed
- canonical/os4ed opensis
- version/os4ed opensis/9.0