CVE-2024-47820
Last modified
CVE-2024-47820 is a low-severity vulnerability rated 3.5/10 on the CVSS scale. MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
Metrics
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Markusproject | Markus | < 2.4.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-47820?
How severe is CVE-2024-47820?
How do I fix CVE-2024-47820?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-47815IncidentReporting is a MediaWiki extension for moving incide…6
- CVE-2024-47816ImportDump is a mediawiki extension designed to automate use…6.4
- CVE-2024-47817Lara-zeus Dynamic Dashboard simple way to manage widgets for…6.1
- CVE-2024-47818Saltcorn is an extensible, open source, no-code database app…6.5
- CVE-2024-47819Umbraco, a free and open source .NET content management syst…8.7
- CVE-2024-4782A denial-of-service vulnerability was reported in some Lenov…6.5
- CVE-2024-47821pyLoad is a free and open-source Download Manager. The folde…2.3
- CVE-2024-47822Directus is a real-time API and App dashboard for managing S…4.2
- CVE-2024-47823Livewire is a full-stack framework for Laravel that allows f…9.8
- CVE-2024-47824matrix-react-sdk is react-based software development kit for…8.7
- CVE-2024-47825Cilium is a networking, observability, and security solution…8.7
- CVE-2024-47826eLabFTW is an open source electronic lab notebook for resear…6.1
Are you affected by CVE-2024-47820?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST