CVE-2024-47820

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-478212.3pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are complete CVE-2024-478224.2Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are p CVE-2024-478239.8Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.1 CVE-2024-478248.7matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 CVE-2024-478258.7Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions CVE-2024-478266.1eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject CVE-2024-478274.8Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in CVE-2024-478286.5ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playli CVE-2024-478296.5pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression func CVE-2024-47836.4The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all CVE-2024-478305.8Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.CVE-2024-478317.5Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerab