An attacker can access the Druid Console’s index.html page without authentication, enabling the exploitation of the StarTraining component. Because the anonymous function in /druid/index.html lacks sufficient authentication checks, any user who reaches this endpoint can interact with the console’s features remotely, potentially retrieving sensitive data or executing administrative actions. The CVE description states that this flaw can be triggered from a remote location and that the exploit is publicly available, indicating that an unauthenticated attacker could leverage the vulnerability immediately if the endpoint is exposed.

All installations of the StarTraining platform from zhistaredu up through version 3.8.1 are affected. The vulnerability resides in the component known as Druid Console. No newer versions beyond 3.8.1 are mentioned as patched.

The flaw carries a CVSS score of 6.9, reflecting medium severity. EPSS information is not provided, and the issue is not listed in the CISA KEV catalog. Because the attack is remote and the exploit is available publicly, the likelihood of exploitation is considered moderate to high in exposed environments. The vendor has not released a patch as of the data provided, which heightens the risk of ongoing exploitation.