Arbitrary file upload in Gunet Openeclass
CVE-2024-38530
The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. This vulnerability is fixed in 3.16.
Vulnerability class: Unrestricted File Upload
EPSS: 0.008 (52.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Gunet Openeclass — versions <= 3.15
- Openeclass
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-38530?
- CVE-2024-38530 is a critical-severity vulnerability in Gunet Openeclass, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2024-08-12.
- How severe is CVE-2024-38530?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2024-38530 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.