CyberSec.Space Logo
Back to CVE Browser

CVE-2014-9753

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1010%
EPSS Percentile26.04th
PublishedFeb 11, 2020
Last ModifiedNov 21, 2024

Vulnerability Description

confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.

Affected Platforms (CPE)

📦
Atutor

Atutor

<= 2.2

References & Advisories

🔗 http://karmainsecurity.com/KIS-2015-06
🔗 http://seclists.org/fulldisclosure/2015/Nov/11
🔗 http://update.atutor.ca/patch/2_2/2_2-6/patch.xml
🔗 http://www.securityfocus.com/archive/1/archive/1/536835/100/0/threaded
🔗 https://github.com/atutor/ATutor/commit/950a0299954e69b8742cc1f1a632f564435d4d7d
🔗 http://karmainsecurity.com/KIS-2015-06
🔗 http://seclists.org/fulldisclosure/2015/Nov/11
🔗 http://update.atutor.ca/patch/2_2/2_2-6/patch.xml

Related Vulnerabilities

CVE-2016-25559.8

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL ...

CVE-2017-10000029.8

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component ...

CVE-2019-161149.8

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which a...

CVE-2017-10000039.8

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application comp...