Information Disclosure exposes The Correct Answers through Debug in Quiz Scoring of IBM KeySkill
Hi! I wanna share my finding about information disclosure due to bad implementation of quiz scoring in CLMS of IBM KeySkill. Since user intercept and click for a random answer then submit it, the HTTP Request containts collection information about the correct answers and state for our current answer (is it correct/wrong).
*reported as "Information Exposure Through Debug Information" and closed as "Informative" in H1, may be due to user can retake the Quiz multiple times so it's not really affected.
You can also check it here / information-disclosure-exposes-the-correct...