Vulnerabilities

TI-2023-23128 CVE-2023-43194 · GHSA-48x9-64j6-vm38

Submitty before v22.06.00 is vulnerable to Incorrect Access Control.

LOW 31

Submitty before v22.06.00 is vulnerable to Incorrect Access Control.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00601 Published 2023-11-02 No fix listed CWE-862

TI-2023-23127 CVE-2023-43193 · GHSA-h4ph-r43q-p9v9

LOW 34

Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00543 Published 2023-11-02 No fix listed CWE-79

TI-2020-10313 CVE-2020-13121 · GHSA-8458-39qw-vw27

LOW 33

Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02932 Published 2020-05-16 No fix listed CWE-601

TI-2020-10243 CVE-2020-12882 · GHSA-2cpf-r6vv-ph3v

LOW 27

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01203 Published 2020-05-15 No fix listed CWE-79