GCVE - cpe:2.3:a:autolabproject:autolab:3.0.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:autolabproject:autolab:3.0.1:*:*:*:*:*:*:*

part: a version: 3.0.1 update: *

Vendor	Autolabproject (`885144bc-cf0e-5de6-8621-51ead702e31f`)
Product	Autolab (`6ba40d78-e4e0-5060-9f4e-480860a9b9d4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/15-411/autolab`	purl2cpe	2026-06-01 10:18:10.824905
`pkg:github/autolab/autolab`	purl2cpe	2026-06-01 10:18:10.824907
`pkg:github/uncc-autolab/autolab`	purl2cpe	2026-06-01 10:18:10.824908

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-52585`	vulnerable	2026-06-08 06:52:16.118073	Autolab has HTML Injection Vulnerability Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html. Published: 2024-11-18T20:45:19.561Z Updated: 2024-11-21T14:47:11.984Z Open on db.gcve.eu Reference links https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2 https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad9554c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-52584`	vulnerable	2026-06-08 06:52:16.117614	Autolab has vulnerable submission endpoints Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs have the authorization level of a CA in the class in the endpoint, which is not necessarily the class the submission is attached to. Version 3.0.2 contains a patch. No known workarounds are available. Published: 2024-11-18T20:43:21.893Z Updated: 2024-11-21T14:54:45.418Z Open on db.gcve.eu Reference links https://github.com/autolab/Autolab/security/advisories/GHSA-rjg4-cf66-x6gr https://github.com/autolab/Autolab/commit/96006d532a392eeca2d350d1811f8e8ab9625bda	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.