CVE-2024-11716: Medium severity ctfd vulnerability
While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636 included in 3.7.5 release.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11716?
CVE-2024-11716 is considered a medium severity vulnerability due to its potential for unauthorized team reassignment during an ongoing competition.
How do I fix CVE-2024-11716?
To fix CVE-2024-11716, ensure you update CTFd to version 3.7.4 or later to close the loophole allowing team reassignment.
Who is affected by CVE-2024-11716?
CVE-2024-11716 affects users of CTFd versions between 3.7.0 and 3.7.4.
What kind of vulnerability is CVE-2024-11716?
CVE-2024-11716 is a logic flaw that allows authenticated users to change their competition bracket during an active event.
Can CVE-2024-11716 lead to competition cheating?
Yes, CVE-2024-11716 can potentially lead to cheating in competitions by allowing users to join different teams mid-event.