Improper Access Control in Koollab LMS via SCORM API

Executive Summary

This vulnerability is an improper access control issue in Koollab LMS. It allows an unauthenticated attacker to access sensitive user data through the SCORM API endpoint, including names, internal identifiers, scores, lesson status, position, and cached lesson state.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to the SCORM API endpoint in Koollab LMS. Check logs for unusual requests to endpoints that expose user data like scores or lesson status. Use tools like Wireshark or curl to inspect HTTP requests targeting the vulnerable endpoint.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal personal or sensitive information about users, such as their progress, scores, or lesson interactions. This could lead to privacy breaches or misuse of user data without their consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing personal or sensitive user data without authorization. Organizations using Koollab LMS may face compliance risks and potential penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the SCORM API endpoint to authenticated users only. Update Koollab LMS to the latest patched version if available. Implement network-level controls to block unauthorized access to sensitive endpoints. Review and audit user permissions to ensure least privilege access.

Useful 0 Not Useful 0