CVE-2024-8001

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative print function with an active session before and after an exam slot to access the entire exam including solutions in the web application. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-80024.3A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality oCVE-2024-80039.8A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of CVE-2024-80045.4A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throughCVE-2024-80059.8A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internaCVE-2024-80064.4Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, oneCVE-2024-80078.1A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an CVE-2024-80085.2A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages CVE-2024-80094.3The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students pageCVE-2024-80107.5The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit aCVE-2024-80115.5Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granteCVE-2024-80127.8An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a localCVE-2024-80133.3A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted f