{"id":"CVE-2024-13110","state":"PUBLISHED","title":"Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure","description":"A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-01-02T13:31:05.521Z","updatedAt":"2025-01-02T14:24:42.884Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Beijing Yunfan Internet Technology Yunfan Learning Examination System"],"affected":[{"vendor":"Beijing Yunfan Internet Technology","product":"Yunfan Learning Examination System","versions":[{"version":"1.9.2","status":"affected"}],"modules":["Exam Answer Handler"]}],"references":["https://vuldb.com/?id.289926","https://vuldb.com/?ctiid.289926","https://vuldb.com/?submit.467700","https://github.com/qiutiandefeng/yfexam-exam/issues/5","https://github.com/qiutiandefeng/yfexam-exam/issues/5#issue-2754675223"],"weaknesses":["CWE-200","CWE-284"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/13xxx/CVE-2024-13110.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-13110","state":"PUBLISHED","datePublished":"2025-01-02T13:31:05.521Z","dateUpdated":"2025-01-02T14:24:42.884Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-01-01T11:31:31.953Z"},"containers":{"cna":{"title":"Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure","descriptions":[{"lang":"en","value":"A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2 entdeckt. Hiervon betroffen ist ein unbekannter Codeblock der Datei src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， der Komponente Exam Answer Handler. Durch Beeinflussen mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Beijing Yunfan Internet Technology","product":"Yunfan Learning Examination System","versions":[{"version":"1.9.2","status":"affected"}],"modules":["Exam Answer Handler"]}],"references":[{"url":"https://vuldb.com/?id.289926","name":"VDB-289926 | Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.289926","name":"VDB-289926 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.467700","name":"Submit #467700 | Beijing Yunfan Internet Technology Co., Ltd yfexam-exam 1.9.2 logical loophole","tags":["third-party-advisory"]},{"url":"https://github.com/qiutiandefeng/yfexam-exam/issues/5","tags":["issue-tracking"]},{"url":"https://github.com/qiutiandefeng/yfexam-exam/issues/5#issue-2754675223","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"Information Disclosure"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-01-02T13:31:05.521Z"},"timeline":[{"time":"2025-01-01T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-01-01T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-01-01T12:36:42.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"LVZC (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-02T14:23:56.299011Z","id":"CVE-2024-13110","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-02T14:24:42.884Z"}}]}}}