CVE-2023-49339 Security Vulnerability Report: Ellucian Banner System

Introduction

This document outlines a critical security vulnerability found in the Ellucian Banner System, particularly in version 9.17 and earlier versions. The vulnerability has been identified in systems used by various universities in Saudi Arabia, potentially exposing sensitive student data.

Vulnerability Details

• Type: Insecure Direct Object Reference (IDOR)
• Endpoint Affected: /StudentSelfService/ssb/studentCard/retrieveData
• Parameter in Question: bannerId
• Impact: Unauthorized exposure of sensitive student data, including personal identifiers, academic records, and contact information.

Steps to Reproduce

1. Log in to the Banner system using legitimate user credentials.
2. Navigate to the URL endpoint that retrieves student card information.
3. Modify the bannerId parameter in the URL to a different student's identifier.
4. Observe that the system displays information for the altered , bypassing necessary authorization checks.