CVE-2024-47876

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
sakaiproject	sakai	>= 23.0, < 23.3
sakaiproject	sakai	<= 23.0; < 23.3

References

https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41Patch
https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qpVendor Advisory
https://sakaiproject.atlassian.net/browse/SAK-50571Permissions Required

Timeline

Published: Oct 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-478777.5Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to creat CVE-2024-478786.1OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint inclu CVE-2024-478798.8OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on CVE-2024-47884.3The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca CVE-2024-478806.9OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a CVE-2024-478818.8OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `databas CVE-2024-478826.1OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page CVE-2024-478839.1The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.UR CVE-2024-478842.4foxmarks is a CLI read-only interface for Firefox's bookmarks and history. A temporary file was created under the /tmp directory with read p CVE-2024-478855.4The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can CVE-2024-478867.2Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code executi CVE-2024-478876.6Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.