Coursemill Learning Management System CVE-2013-3601

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2013-09-06 cret@cert.org

Privilege Escalation Coursemill Learning Management System

6.0

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

6.0 MEDIUM

AV:N/AC:M/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:S/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

M

Confidentiality

P

Integrity

P

Availability

P

Lifecycle Timeline

1

CVE Published

Sep 06, 2013 - 11:15 cve.org

MEDIUM 6.0

DescriptionCVE.org

Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter.

AnalysisAI

Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter. Affected products include: Trivantis Coursemill Learning Management System.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Coursemill Learning Management System

View all

CVE-2013-3599 CRITICAL Act Now

userlogin.jsp in Coursemill Learning Management System (LMS) 6.6 and 6.8 allows remote attackers to gain privileges via

CVE-2013-3600 HIGH This Week

Coursemill Learning Management System (LMS) 6.6 allows remote authenticated users to gain privileges via a modified user

CVE-2013-3602 HIGH This Week

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System (LMS) 6.6 allows remote

CVE-2013-5708 MEDIUM This Month

Coursemill Learning Management System (LMS) 6.8 constructs secret tokens based on time values, which makes it easier for

CVE-2013-3605 MEDIUM This Month

Cross-site request forgery (CSRF) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attacke

CVE-2013-5707 MEDIUM This Month

Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote atta

CVE-2013-5706 MEDIUM This Month

Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote atta

CVE-2013-3604 MEDIUM This Month

Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6 allow remote atta

CVE-2013-3603 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in Coursemill Learning Management System (LMS) 6.6 allows remote attackers to i

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2013-3601 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy