Vulnerability in handling of uploaded QTI ZIP files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packages as ZIP files. The ZIP handling code does not sufficiently check the paths of files contained within ZIP files, so can insert files into other locations in the filesystem if they are writable by the process running the QTIWorks Engine. In extreme cases, this could allow anonymous users to change files in arbitrary locations in the filesystem. In normal QTIWorks Engine deployments, the impact is somewhat reduced because the default QTIWorks configuration does not enable the public demo functionality, so ZIP files can only be uploaded by users with "instructor" privileges. This vulnerability is fixed in version 1.0-beta15. There are no database configuration changes required when upgrading to this version. No known workarounds for this issue exist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| davemckain | qtiworks | before 1.0-beta15 | 1.0-beta15 | Patch available | CNA |
- qtiworks Vendordavemckain Affected before 1.0-beta15 Fixed in 1.0-beta15 Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qtiworks_project:qtiworks:*:*:*:*:*:*:*:* | before 1.0 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:-:*:*:*:*:*:* | 1.0 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta1:*:*:*:*:*:* | 1.0 beta1 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta10:*:*:*:*:*:* | 1.0 beta10 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta11:*:*:*:*:*:* | 1.0 beta11 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta12:*:*:*:*:*:* | 1.0 beta12 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta13:*:*:*:*:*:* | 1.0 beta13 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta14:*:*:*:*:*:* | 1.0 beta14 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta2:*:*:*:*:*:* | 1.0 beta2 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta3:*:*:*:*:*:* | 1.0 beta3 | Vulnerable | Qtiworks Project |
- cpe:2.3:a:qtiworks_project:qtiworks:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta1:*:*:*:*:*:* Versions 1.0 beta1 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta10:*:*:*:*:*:* Versions 1.0 beta10 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta11:*:*:*:*:*:* Versions 1.0 beta11 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta12:*:*:*:*:*:* Versions 1.0 beta12 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta13:*:*:*:*:*:* Versions 1.0 beta13 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta14:*:*:*:*:*:* Versions 1.0 beta14 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta2:*:*:*:*:*:* Versions 1.0 beta2 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta3:*:*:*:*:*:* Versions 1.0 beta3 Vulnerable ·Qtiworks Project
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta4:*:*:*:*:*:* | 1.0 beta4 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta5:*:*:*:*:*:* | 1.0 beta5 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta6:*:*:*:*:*:* | 1.0 beta6 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta7:*:*:*:*:*:* | 1.0 beta7 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta8:*:*:*:*:*:* | 1.0 beta8 | Vulnerable | Qtiworks Project |
| cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta9:*:*:*:*:*:* | 1.0 beta9 | Vulnerable | Qtiworks Project |
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta4:*:*:*:*:*:* Versions 1.0 beta4 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta5:*:*:*:*:*:* Versions 1.0 beta5 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta6:*:*:*:*:*:* Versions 1.0 beta6 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta7:*:*:*:*:*:* Versions 1.0 beta7 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta8:*:*:*:*:*:* Versions 1.0 beta8 Vulnerable ·Qtiworks Project
- cpe:2.3:a:qtiworks_project:qtiworks:1.0:beta9:*:*:*:*:*:* Versions 1.0 beta9 Vulnerable ·Qtiworks Project
Remediation
- Fix · CNA qtiworks (davemckain) Fixed in 1.0-beta15
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39367
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences