CVE-2024-3139: oretnom23 computer_laboratory_management_system Improper Authorization
Vulnerability summary
CVE-2024-3139 is a medium (CVSS 5.5) Improper Authorization vulnerability in oretnom23 computer_laboratory_management_system. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 01-04-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to this vulnerability.
CVSS metrics
5 scores · 2 sources · 3 versions- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.5MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
EPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
0.00 pp
From 0.49% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundZday1
Maturity: poc
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected systems
Oretnom231 product
Sourcecodester1 product
2 vendors · 2 products
References
4 links- vuldb.com?submit.308207Third Party Advisory