Medium severity · published Jan 11, 2024
CVE-2023-6554
Missing authorisation in TCExam
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
When access to the "admin" folder is not protected by some external authorization mechanisms e.g. Apache Basic Auth, it is possible for any user to download protected information like exam answers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TCExam · Tecnick.com
before 15.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6554
Third Party Advisory
https://cert.pl/en/posts/2024/01/CVE-2023-6554/
Third Party Advisory
https://cert.pl/posts/2024/01/CVE-2023-6554/
Product
https://tcexam.org/
More from TCExam
–
CVE-2007-6288
Multiple SQL injection vulnerabilities in TCExam before 5.1.000 allow remote attackers to execute arbitrary SQL commands via unspecified vectors
–
CVE-2007-2430
shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal…
–
CVE-2007-2431
Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly…