VIWIS LMS Print authorization

Vulnerability

The vulnerability exists in the Print Handler component of VIWIS LMS version 9.11, where an administrative print function lacks proper authorization checks. This allows users with the learner role to access the print functionality, which should be restricted to administrators. The issue is classified as critical due to the potential for unauthorized access to sensitive exam data.

Exploitation

An attacker must have a valid learner account and an active session. By accessing the administrative print function before or after an exam slot, the attacker can remotely retrieve the entire exam content including solutions. No additional privileges or user interaction beyond the learner role are required [1].

Impact

Successful exploitation leads to unauthorized information disclosure, specifically the full exam questions and solutions. This compromises the integrity of exams and could allow learners to gain an unfair advantage. The scope is limited to the web application's exam data, but the impact is considered high due to the sensitivity of the information.

Mitigation

A patch is recommended by the vendor to fix the missing authorization. As of the publication date (2024-11-13), the patch is available. No workarounds are documented. Users should update to the latest version of VIWIS LMS to mitigate the vulnerability [1].