CVE-2023-49339: 
NixOS vulnerability analysis and mitigation

CVE-2023-49339 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in Ellucian Banner version 9.17. The vulnerability allows unauthorized access to student data through the /StudentSelfService/ssb/studentCard/retrieveData endpoint by modifying the bannerId parameter (NVD, GitHub POC).

The vulnerability is classified as an Authorization Bypass Through User-Controlled Key (CWE-639). It has a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and high confidentiality impact (NVD).

The vulnerability allows unauthorized access to sensitive student information through the manipulation of the bannerId parameter. This could lead to exposure of personal identifiers, academic records, and contact information of students (GitHub POC).

Institutions using Ellucian Banner version 9.17 or earlier should implement strict authorization checks on the affected endpoint and conduct thorough system audits to identify similar vulnerabilities. Regular system updates and security training are recommended (GitHub POC).