CVE-2017-1000002
CriticalSummary
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. Additionally, these versions are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.
Risk Assessment
This vulnerability may lead to unauthorized code execution and disclosure of sensitive information, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to upgrade to the latest version of ATutor to mitigate these vulnerabilities and implement additional security measures such as access monitoring.
Original NVD description (English source)
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.