Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Learning_management_system | Wisetail | * | 4.11.6 (including) |