CVE-2024-42988: Medium severity ctfd vulnerability
Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42988?
CVE-2024-42988 has a moderate severity level due to improper access control leading to potential privacy violations.
How do I fix CVE-2024-42988?
To fix CVE-2024-42988, upgrade CTFd to version 3.7.3 or later.
What is the impact of CVE-2024-42988 on users?
CVE-2024-42988 allows authenticated users to access sensitive information about other users' challenge solutions, compromising their privacy.
Which versions of CTFd are affected by CVE-2024-42988?
CTFd versions 2.0.0 through 3.7.2 are affected by CVE-2024-42988.
Is CVE-2024-42988 exploitable by unauthenticated users?
CVE-2024-42988 is not directly exploitable by unauthenticated users as it requires user authentication.