Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2022-28924: An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
CVE-2022-28924 · published 4 years ago
Summary
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
What to do
- Update universis universis-students to version 1.5.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| universis | universis-students |
< 1.5.0 cpe:2.3:a:universis:universis-students:*:*:*:*:*:*:*:* |
Original advisory text
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
References
- https://suumcuique.org/blog/posts/information-disclosure-vulnerability-universis Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published18 May 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-28924 · NVD
Track software like this
Free during beta