CVE-2024-49376 — Vulnerability in Autolab — CVE Details

HIGH

Autolab Misconfigured Reset Password Permissions

Published October 25, 2024Updated November 15, 2024Source: osv

Summary

### Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. ### Patches This is fixed in v3.0.1. ### Workarounds No workarounds. ### For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/autolab/Autolab/ Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)

Advisory Timeline

First published October 25, 2024 (717 days ago).
Last revised November 15, 2024 — 20 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update Autolab to 3.0.1 or later

gem install Autolab -v 3.0.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

Package	Ecosystem	Affected	Fixed In
Autolab	rubygems	3.0.0	3.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-287
Improper AuthenticationMITRE
CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-49376?: Autolab Misconfigured Reset Password Permissions This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2024-49376?: CVE-2024-49376 affects Autolab. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-49376 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-v46j-h43h-rwrm

Related CVEs

CVE-2026-94462
HIGH
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
CVE-2026-77601
HIGH
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies