Openeclass GUnet OpenEclass 1.7.3 (2007) Module information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Openeclass GUnet OpenEclass 1.7.3 (2007). Affected by this issue is some unknown functionality of the component Module. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2020-37114. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Openeclass GUnet OpenEclass 1.7.3 (2007). This affects an unknown functionality of the component Module. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization.

The weakness was disclosed by emaragkos as 48163. The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2020-37114 since 02/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Openeclass

Name

• GUnet OpenEclass

Version

• 1.7.3 (2007)

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion