Vendor
Three Learning
16 known vulnerabilities.
6 results · Clear filters · Feed
-
Medium 4.3
Business logic vulnerability
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records.
-
Medium 4.3
Information disclosure vulnerability
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments.
-
Medium 5.4
Hard-coded AWS IAM credentials vulnerability
A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.
-
Medium 6.5
Authentication bypass vulnerability
An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.
-
Medium 4.8
TOTP two-factor authentication bypass vulnerability
A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to admin…
-
Medium 5.4
Stored Cross-Site Scripting (XSS) Vulnerability
Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitrary JavaScript on any user account that has access to Koollab LMS’ courselet feature.