CVE-2022-41955

    Dashboard / Vulnerabilities / CVE-2022-41955

    CVE-2022-41955

    Published: 14 Jan 2023Last Modified: 12 Aug 2026

    Summary: Autolab is vulnerable to remote code execution (RCE) via MOSS functionality

    Details: Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41955.json, https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269, https://nvd.nist.gov/vuln/detail/CVE-2022-41955, https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- cd657951bbf92512d47a61f5551038a4ea4ff479
    Fixed -67f6644ae586a6031bb08a94ff04e50181bc8ab3

    Affected versions

    v2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-41955 | CVE-DB