CVE-2020-24381

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://emaragkos.gr/cve-2020-24381/Third Party Advisory
https://github.com/gunet/openeclass/issues/39Exploit, Issue Tracking, Patch, Third Party Advisory
https://emaragkos.gr/cve-2020-24381/Third Party Advisory
https://github.com/gunet/openeclass/issues/39Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-243839.1An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\0' termin CVE-2020-243849.8A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability CVE-2020-243855.5In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation la CVE-2020-243866.8An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-contr CVE-2020-243877.5An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the retur CVE-2020-243887.5An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded lengt CVE-2020-243906.1eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authenticat CVE-2020-243919.8mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-CVE-2020-243925.9In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of t CVE-2020-243935.9TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to pe CVE-2020-243947.1In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesys CVE-2020-243956.8The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install comprom