CVE-2017-1000002 ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vul...
CriticalCVSS 9.8
EPSS 30.8%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atutor | <= 2.2.1 | No fix listed |
References
- www.atutor.ca vendor-advisory
- www.atutor.ca permissions-required
- 99599 third-party-advisory vdb-entry