Frappe had attachments made by students to their assignments of type Text set to public

Frappe Learning is a learning system that helps users structure their content. In versions prior to 2.38.0, the system did stored the attachments uploaded by the students in their assignments as public files. This issue potentially exposed student-uploaded files to the public. Anyone with the file URL could access these files without authentication. The issue has been fixed in version 2.38.0 by ensuring all student-uploaded assignment attachments are stored as private files by default.

N/A

信息暴露

Frappe Learning 信息泄露漏洞

Frappe Learning是Frappe开源的一个易于使用的开源学习管理系统。 Frappe Learning 2.38.0之前版本存在信息泄露漏洞，该漏洞源于学生上传的作业附件被存储为公开文件，可能导致未经身份验证的任意用户访问这些文件。

N/A

N/A