Low severity · published Nov 18, 2024
CVE-2024-47820
MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8
3.5
CVSS
0.7%
EPSS
No
On KEV
Description
MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Markus · Markusproject
before 2.4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47820
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47820
Patch
https://github.com/MarkUsProject/Markus/pull/7026
Third Party Advisory
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-wq6v-vx8c-8fj8
More from Markus
9.1
CVE-2026-25057
Zip Slip in MarkUs config upload allowing RCE
8.8
CVE-2024-51743
MarkUs is a web application for the submission and grading of student assignments
8.8
CVE-2024-51499
MarkUs is a web application for the submission and grading of student assignments
6.5
CVE-2026-25962
MarkUs: Zip bomb in config upload enables DoS
6.5
CVE-2026-24900
MarkUs has a submission-view IDOR exposes all student submissions