CVE-2023-27485

low-risk
Published 2023-03-07

thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Feedbacksystem

Affected Vendors

Thm

References (8)

Patch https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb1594903847...
Release Notes https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3
Patch https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-...
Product https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/g...
Patch https://github.com/thm-mni-ii/feedbacksystem/commit/f1ae67d8bb2286a8eb1594903847...
Release Notes https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.5.3
Patch https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-fhq8-p3w6-...
Product https://thm-mni-ii.github.io/feedbacksystem/api-docs/#tag/Submission/operation/g...
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal