CyberRota Analysis
AI-GeneratedA path traversal vulnerability in ATutor allows authenticated users to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled, potentially leading to unauthorized file access and exposure of filesystem information. Given that the product is no longer actively supported and the vulnerabilities remain unpatched, organizations still using version 2.2.4 or similar should prioritize this issue to mitigate risks of information disclosure.
Original NVD Description
A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.