CVE-2013-3601

Estado: ModificadaMedia (6)—

Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter.

CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Puntuación base: 6

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.03%
Percentil entre todas las CVEs puntuadas: 62
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Trivantis — Coursemill Learning Management System

CWE

CWE-264

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2013-3601",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-09-06T11:15:37.287",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/960908",
      "tags": [
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/960908",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter."
    },
    {
      "lang": "es",
      "value": "Coursemill Learning Management System (LMS) 6.6 no restringe apropiadamente llamadas a función JSP, lo que permite a usuarios remotos autentificados realizar operaciones JSP a discrección aprovechando el rol \"Student\" y proporcionando un parametro \"op\"."
    }
  ],
  "lastModified": "2026-06-16T23:55:29.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trivantis:coursemill_learning_management_system:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0895E52C-0F40-4E0C-9064-295673A57C68"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}