Skip to content

Tar slip in cheat checker functionality (`GHSL-2023-082`)

Moderate
damianhxy published GHSA-h8g5-vhm4-wx6g May 21, 2023

Package

bundler Autolab (RubyGems)

Affected versions

<= 2.10.0

Patched versions

2.11.0

Description

Impact

A Tar slip vulnerability was found in Autolab's MOSS functionality, whereby an instructor with access to the feature can perform an arbitrary file write.

Patches

The vulnerability has been patched in v2.11.0.

Workarounds

There are no feasible workarounds for this issue.

References

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
6.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

CVE ID

CVE-2023-32317

Weaknesses

Credits