CVE-2024-53260

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and opens, this name will then be evaluated as a formula. This could lead to leakage of information of students in the course roster by sending the data to a remote endpoint. This issue has been patched in the source code repository and the fix is expected to be released in the next version. Users are advised to manually patch their systems or to wait for the next release. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-1236

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-532615.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* CVE-2024-532625.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors CVE-2024-532638.5Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of t CVE-2024-532645.1bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint CVE-2024-532665.4Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled CVE-2024-532675.5sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situ CVE-2024-532688.8Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected ver CVE-2024-532697.5Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs so CVE-2024-53275.4The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to DOM-Based Stored Cross-Sit CVE-2024-532707.5Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active r CVE-2024-532717.1Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1x CVE-2024-532726.1Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` an