VULHUB ™

It is reported that Blackboard improperly allows users to download files posted in the 'Digital Dropbox'. Files in the dropbox are intended for the course administrators. The application does not verify that the files requested for download are intended for the requester. No authorization checks are performed, and the file is served to anybody that can guess the URI. An attacker would use this vulnerability to download potentially sensitive information. This vulnerability is reported to exist in the Blackboard Learning System - Basic Edition (release 6), but likely exists in others as well.

It is reported that Blackboard improperly allows users to download files posted in the 'Digital Dropbox'. Files in the dropbox are intended for the course administrators. The application does not verify that the files requested for download are intended for the requester. No authorization checks are performed, and the file is served to anybody that can guess the URI. An attacker would use this vulnerability to download potentially sensitive information. This vulnerability is reported to exist in the Blackboard Learning System - Basic Edition (release 6), but likely exists in others as well.