CVE-2017-1000003

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Module component resulting in privilege escalation. ATutor versions 2.2.1 and earlier are vulnerable to a incorrect access control check vulnerability in the Alternative Content component resulting in privilege escalation.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jul 17, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10000049.8ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email,CVE-2017-10000056.1PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeCVE-2017-10000066.1Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.CVE-2017-10000075.9txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information diCVE-2017-10000088.8Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged iCVE-2017-10000099.8Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.CVE-2017-10000107.8Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.CVE-2017-10000116.1MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of informationCVE-2017-10000126.1MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the userCVE-2017-10000136.1phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weaknessCVE-2017-10000147.5phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionalityCVE-2017-10000156.1phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
CVE-2017-1000003: Critical severity, CVSS 9.8 | Vulnix