CVE-2024-12306

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12306
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12306.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12306
Published
2024-12-09T08:50:23.241Z
Modified
2026-08-12T03:51:29.979907511Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform
Details

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level access control issues in profile viewing endpoints. A malicious student user can access personal information of other students and teachers through these vulnerabilities. At the time of publication of the CVE no patch is available.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-639"
    ],
    "cna_assigner": "NCSC.ch",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12306.json"
}
References

Affected packages

Git / github.com/changeweb/unifiedtransform

Affected ranges

Type
GIT
Repo
https://github.com/changeweb/unifiedtransform
Events
Introduced
59d6627460d8782334a73dd486c07b8557ac795d
Last affected
59d6627460d8782334a73dd486c07b8557ac795d
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        }
    ]
}

Affected versions

2.*
2.0
v2.*
v2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12306.json"