1. Home
  2. CVE Database
  3. CVE-2024-38530
CRITICAL · 9.8

CVE-2024-38530

The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthent...

Vulnerability Description

The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. This vulnerability is fixed in 3.16.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
OpeneclassOpeneclass< 3.16

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2024-38530?

CVE-2024-38530 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthent...

How severe is CVE-2024-38530?

CVE-2024-38530 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-38530?

Check the references section above for vendor advisories and patch information. Affected products include: Openeclass Openeclass.