Lms CVE-2024-25270

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2024-09-12 cve@mitre.org

Authentication Bypass Lms

4.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Sep 12, 2024 - 19:15 nvd

MEDIUM 4.3

DescriptionNVD

An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data.

AnalysisAI

An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-639. An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data. Affected products include: Mirapolis Lms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Lms

View all

CVE-2018-1000535 HIGH This Week POC

lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module tha

CVE-2026-39405 CRITICAL Act Now

Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with cour

CVE-2026-40456 HIGH This Week

OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to exe

CVE-2026-40455 HIGH This Week

Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract

CVE-2026-39385 HIGH This Week

Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by

CVE-2026-27404 HIGH This Week

Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated

CVE-2026-34606 MEDIUM This Month

Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthentic

CVE-2026-39415 MEDIUM This Month

Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores

CVE-2026-40457 LOW Monitor

Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitra

CVE-2026-46546 LOW Monitor

Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all

CVE-2024-50483 CRITICAL

CVE-2026-55255 HIGH POC

CVE-2025-3605 CRITICAL POC

CVE-2022-3805 HIGH POC

CVE-2025-5947 CRITICAL POC

CVE-2020-36923 CRITICAL POC

CVE-2025-14998 CRITICAL POC

CVE-2023-3048 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2024-25270 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy