Read the docs
TI-2024-35244 Aliases CVE-2024-52584

Autolab has vulnerable submission endpoints

Priority LOW 22CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
autolabAutolab= 3.0.1—No fix listedCNA
  • Autolab Vendorautolab Affected = 3.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:autolabproject:autolab:3.0.1:*:*:*:*:*:*:*3.0.1Vulnerableautolab
  • cpe:2.3:a:autolabproject:autolab:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·autolab

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52584

References

Patch 1

Advisory 1

  • TI-2023-15952 Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`) CVSS 3.1HIGH 7.2
  • TI-2022-20296 Autolab is vulnerable to remote code execution (RCE) via MOSS functionality CVSS 3.1HIGH 8.8
  • TI-2023-15611 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`) CVSS 3.1HIGH 7.2
  • TI-2022-20297 Autolab is vulnerable to file disclosure via remote handin feature CVSS 3.1MEDIUM 6.5
  • TI-2024-35721 download_all_submissions allows student to download another student's submissions in Autolab CVSS 4.0HIGH 7.1
  • TI-2024-32961 Autolab Has Misconfigured Reset Password Permissions CVSS 4.0HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences