CVE-2026-64965— ATutor 缺少授权检查漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-64965の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Missing Authorization Check in ATutor
ソース: CVE Program / CVE List V5
脆弱性説明
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制缺失
ソース: CVE Program / CVE List V5
影響を受ける製品
II. CVE-2026-64965の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-64965のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-64965 安全博客文章 (1)
- 🔗 Vulnerabilities in ATutor software | CERT Polskathird-party-advisory
Same Patch Batch · ATutor · 2026-08-20 · 13 CVEs total
| CVE-2026-64960 | 8.7 HIGH | Remote Code Execution via Unrestricted File Upload in ATutor |
| CVE-2026-64966 | 8.7 HIGH | Path Traversal leading to Remote Code Execution in ATutor |
| CVE-2026-64967 | 6.9 MEDIUM | Path Traversal in ATutor |
| CVE-2026-64964 | 6.3 MEDIUM | Generation of Predictable Email Confirmation Token in ATutor |
| CVE-2026-64961 | 6.3 MEDIUM | Authentication Bypass in ATutor |
| CVE-2026-64969 | 5.3 MEDIUM | Insecure Direct Object Reference in ATutor |
| CVE-2026-64968 | 5.1 MEDIUM | Server-Side Request Forgery in ATutor |
| CVE-2026-64962 | 5.1 MEDIUM | Cross-Site Request Forgery (CSRF) in ATutor |
| CVE-2026-64970 | 5.1 MEDIUM | Stored XSS in ATutor |
| CVE-2026-64971 | 4.8 MEDIUM | Reflected XSS in ATutor |
| CVE-2026-64972 | 4.8 MEDIUM | Reflected XSS in ATutor |
| CVE-2026-64963 | 2.3 LOW | Path Traversal in ATutor |
IV. 関連脆弱性
同じ弱点: CWE-862
- CVE-2026-34836
Combodo iTop: Improper access control in ajax.render.php and - CVE-2026-53487
Kite has an authenticated cluster RBAC bypass in /api/v1/ove - CVE-2026-33047
Combodo iTop: Object can be locked by a user without write p - CVE-2026-31936
Combodo iTop: Unauthorized access to object information via - CVE-2026-76876
Craftplan < 0.5.1 Broken Access Control Information Disclosu
V. CVE-2026-64965へのコメント
まだコメントはありません