Impact

Path traversal vulnerabilities were discovered in Autolab's assessment functionality, whereby instructors can perform arbitrary file reads.

Patches

The vulnerability has been patched in v2.12.0 and can no longer be exploited by new or existing assessments.

Workarounds

There are no feasible workarounds for this issue.

References

• Rails Path Traversal

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/autolab/Autolab/
• Email us at autolab-dev@andrew.cmu.edu