Unscored severity · published Sep 6, 2013
CVE-2013-3601
Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by…
–
CVSS
1%
EPSS
No
On KEV
Description
Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Coursemill Learning Management System · Trivantis
6.6 · source: NVD
Affected product
CL
Coursemill Learning Management System
Trivantis
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3601
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3601
US Government Resource
http://www.kb.cert.org/vuls/id/960908
More from Coursemill Learning Management System
–
CVE-2013-5708
Coursemill Learning Management System (LMS) 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery…
–
CVE-2013-5707
Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted…
–
CVE-2013-5706
Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors…
–
CVE-2013-3605
Cross-site request forgery (CSRF) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to hijack the authentication of arbitrary users via…
–
CVE-2013-3604
Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted…