CVE-2024-53258

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature.

• CWE-359
• CWE-862
• CWE-862

• https://github.com/autolab/Autolab/commit/1aa4c7690892fb458d2c61ff86739f368e34769dPatch
• https://github.com/autolab/Autolab/security/advisories/GHSA-84qc-7773-2gg3Vendor Advisory

Published

Nov 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53252Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-53253Sentry is an error tracking and performance monitoring platf…5.3
• CVE-2024-53254Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2024-53255BoidCMS is a free and open-source flat file CMS for building…5.4
• CVE-2024-53256Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2024-53257Vitess is a database clustering system for horizontal scalin…4.9
• CVE-2024-53259quic-go is an implementation of the QUIC protocol in Go. An …6.5
• CVE-2024-5326The Post Grid Gutenberg Blocks and WordPress Blog Plugin – P…8.8
• CVE-2024-53260Autolab is a course management service that enables auto-gra…6.8
• CVE-2024-53261SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53262SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2024-53263Git LFS is a Git extension for versioning large files. When …8.5