Medium severity6.5NVD Advisory· Published May 18, 2022· Updated Jun 17, 2026

CVE-2022-28924

Description

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.

Affected products

Universis/Universis Students
cpe:2.3:a:universis:universis-students:*:*:*:*:*:*:*:*
Range: <1.5.0
UniverSIS-Students/UniverSIS-Studentsdescription
UniverSIS-Students/UniverSIS-Studentsllm-fuzzy
Range: <1.5.0

Patches

Vulnerability mechanics

References

suumcuique.org/blog/posts/information-disclosure-vulnerability-universisnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000