CVE-2022-41955

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.

• CWE-78
• CWE-77

• https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/
• https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/

Published

Jan 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4195Insufficient policy enforcement in Safe Browsing in Google C…4.3
• CVE-2022-41950super-xray is the GUI alternative for vulnerability scanning…7.8
• CVE-2022-41951OroPlatform is a PHP Business Application Platform (BAP) des…9.8
• CVE-2022-41952Synapse before 1.52.0 with URL preview functionality enabled…5.3
• CVE-2022-41953Git GUI is a convenient graphical tool that comes with Git f…7.8
• CVE-2022-41954MPXJ is an open source library to read and write project pla…3.3
• CVE-2022-41956Autolab is a course management service, initially developed …6.5
• CVE-2022-41957Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2022-41958super-xray is a web vulnerability scanning tool. Versions pr…7.8
• CVE-2022-4196The Multi Step Form WordPress plugin before 1.7.8 does not s…4.8
• CVE-2022-41960BigBlueButton is an open source web conferencing system. Ver…4.3
• CVE-2022-41961BigBlueButton is an open source web conferencing system. Ver…4.3