CVE-2018-16367

In OnlineJudge 2.0, the sandbox has an incorrect access control vulnerability that can write a file anywhere. A user can write a directory listing to /tmp, and can leak file data with a #include.

Score

CVSS 3.0 9.9 Critical

Status

Modified - cve@mitre.org

Published

2018-09-02

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Onlinejudge (Qduoj)

References

• https://github.com/QingdaoU/OnlineJudge/issues/165