CVE-2023-27485

MEDIO 4.3CVE-2023-27485 · Published 07/03/2023 · updated 17/06/2026

In breve

CVE-2023-27485 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda feedbacksystem (thm).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.51%, superiore al 43.4% delle vulnerabilità.
Correzione: aggiornare a 1.5.3 o successiva.

Package	Affected versions	Patched versions
feedbacksystem thm	`< 1.5.3`	`1.5.3`

Description

thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.

References

thm-mni-ii/feedbacksystem commit f1ae67d · Patch
thm-mni-ii/feedbacksystem release v1.5.3 · Release Notes
thm-mni-ii/feedbacksystem security advisory · Patch
thm-mni-ii.github.io/feedbacksystem/api-docs · Product

Altre vulnerabilità di feedbacksystem

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free