Auth bypass in Atutor
CVE-2019-16114
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host, db_login, db_password, and content_dir) within install/include/step5.php.
Vulnerability class: Broken Access Control
EPSS: 0.048 (91.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Atutor
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch, x_refsource_MISC)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-16114?
- CVE-2019-16114 is a critical-severity vulnerability in Atutor, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2019-09-09.
- How severe is CVE-2019-16114?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-16114 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.