CVE-2024-47876 json
Sakai: Kernel users created with type roleview can login as a normal user
published 2024-10-15 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3022 , GHSA-cx95-q6gx-w4qp
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability.
Patch / fix
- maven org.sakaiproject.kernel:sakai-kernel-impl 23.3
- sakaiproject sakai 23.3
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.sakaiproject.kernel:sakai-kernel-impl | >=23.0, <23.3 |
23.3 |
Affected products
- sakaiproject sakai
Classification
References
-
github.com
/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41
web, patch
-
github.com
/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp
web, vendor-advisory
-
sakaiproject.atlassian.net
/browse/SAK-50571
web, permissions-required
-
nvd.nist.gov
/vuln/detail/CVE-2024-47876
advisory
-
central.sonatype.com
/artifact/org.sakaiproject.kernel/sakai-kernel-impl
web
-
github.com
/sakaiproject/sakai
package
Sources
- CVE List CVE-2024-47876
- GitHub Advisory GHSA-cx95-q6gx-w4qp
- NVD CVE-2024-47876
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.