| Version | Supported |
|---|---|
| > 2.5 | ✅ |
Send an email to autolab-dev@andrew.cmu.edu to report a vulnerability.
Please do not publicly disclose the security vulnerability for at least 28 days, such that the Autolab team has ample time to address the issue.
Security: autolab/Autolab
Security
SECURITY.md
-
Course Roster vulnerable to CSV InjectionGHSA-cqxx-pfmh-h43g published
Nov 27, 2024 by 20wildmanjModerate -
download_all_submissions allows student to download another student's submissionsGHSA-84qc-7773-2gg3 published
Nov 25, 2024 by 20wildmanjHigh -
Vulnerable submission endpointsGHSA-rjg4-cf66-x6gr published
Nov 18, 2024 by dwang3851High -
HTML Injection VulnerabilityGHSA-8qhp-jhhw-45r2 published
Nov 18, 2024 by 20wildmanjModerate -
Misconfigured Reset Password PermissionsGHSA-v46j-h43h-rwrm published
Oct 25, 2024 by KesterTanHigh -
Path Traversal vulnerability in Assessment functionalityGHSA-h8wq-ghfq-5hfx published
Jan 21, 2024 by damianhxyModerate -
Tar slip in cheat checker functionality (`GHSL-2023-082`)GHSA-h8g5-vhm4-wx6g published
May 21, 2023 by damianhxyModerate -
Tar slip in Install Assessment functionality (`GHSL-2023-081`)GHSA-x9hj-r9q4-832c published
May 21, 2023 by damianhxyModerate -
Session forgery/admin impersonation vulnerability in recommended Autolab setup (GHSL-2023-030)GHSA-962r-m9fj-3hj9 published
May 21, 2023 by damianhxyHigh -
File disclosure via remote handin featureGHSA-g7x7-mgrv-f24x published
Jan 13, 2023 by damianhxyModerate
Learn more about advisories related to autolab/Autolab in the GitHub Advisory Database