CVE-2024-47876 Sakai: Kernel users created with type roleview can login as a normal user
HighCVSS 8.7
EPSS 0.57%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.sakaiproject.kernel/sakai-kernel-impl(Maven) | >= 23.0, < 23.3 | 23.3 |
| org.sakaiproject.kernel/sakai-kernel-impl(Maven) | = 23.0 | No fix listed |
| org.sakaiproject.kernel/sakai-kernel-impl(Maven) | = 23.1 | No fix listed |
| org.sakaiproject.kernel/sakai-kernel-impl(Maven) | = 23.2 | No fix listed |
| sakaiproject sakai | = >= 23.0, < 23.3 | No fix listed |
| sakaiproject sakai | <= 23.0 | No fix listed |
| sakaiproject sakai | < 23.3 | 23.3 |
| sakailms sakai | >= 23.0, < 23.2 | 23.2 |
References
- https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41 patch
- central.sonatype.com
- github.com product
- https://sakaiproject.atlassian.net/browse/SAK-50571 permissions-required
- github.com