Security Advisory

CVE-2024-42988

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-10-09 00:00:00

Last updated 2025-02-10 22:49:11

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+.

← Browse all CVEs View on cve.org ↗