Skip to main content

Improper Authorization

CVE-2024-47876

High
8.7/10

Summary

Sakai is a Collaboration and Learning Environment. In org.sakaiproject.kernel:sakai-kernel-impl package version 23.0 through 23.2, kernel users created with type "roleview" can log in as a normal user. This can result in illegal access being granted to the system.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published