CVE-2023-0994: 
PHP vulnerability analysis and mitigation

CVE-2023-0994 is a vulnerability identified in the GitHub repository francoisjacquet/rosariosis versions prior to 10.8.2, involving the exposure of sensitive information to unauthorized actors. The vulnerability was disclosed on February 23, 2023, affecting the RosarioSIS software system (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and primarily impacts confidentiality (NVD).

The vulnerability allows unauthorized actors to access sensitive information. The high confidentiality impact (C:H) in the CVSS score suggests that the exposure could result in total information disclosure, with all system files being revealed to the attacker (NVD).

The vulnerability has been patched in RosarioSIS version 10.8.2. The fix involves adding microseconds to filenames to make them harder to predict, as implemented in the StudentAssignments.fnc.php file (GitHub Patch).