CVE-2013-3601: Coursemill Learning Management System (LMS) 6.6 does not properly restrict JSP function calls, which allows...

Security readout for executives and security teams

Coursemill LMS 6.6 allowed a normal student account to reach JSP operations that should have been restricted. For an organization using that LMS, this could turn a low-privilege authenticated user into someone able to perform unintended application actions. Exposure appears limited to organizations running Coursemill Learning Management System 6.6, especially where student authentication is available remotely. The source bundle does not confirm other affected versions, deployment types, or CPE mappings. Treat as a targeted LMS access-control risk, not a confirmed internet-wide emergency. Prioritize validation if Coursemill LMS 6.6 is used for students, partners, or public-facing training portals. Mitigation focus: Identify any Coursemill LMS 6.6 deployments in your environment.; Check vendor guidance and CERT VU#960908 for fixes or mitigations.; Restrict LMS access to trusted networks until guidance is confirmed..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.