Education IT Reporter

The U.S. Department of Education (Department) is working with Ellucian to clarify the previous alert from July 17, 2019. Some of the issues mentioned in the alert may be unrelated to the vulnerability (Vulnerability) for which Ellucian released a patch on May 14, 2019. The Department and Ellucian have no reason to suspect that a breach has occurred as a result of this vulnerability.

Ellucian has found that there are two separate and distinct issues that bear immediate attention:

1. The Ellucian Banner vulnerability
2. Fraudulent admissions applications

The Ellucian Banner Vulnerability

Who is Impacted: The vulnerability only occurs in Ellucian Banner Web Tailor versions 8.8.3, 8.8.4, and Banner Enterprise Identity Services versions 8.3, 8.3.1, 8.3.2, and 8.4. Although Banner Web Tailor 8.9 was previously listed as impacted, it is a roll-up software release that contains all patches and releases since 8.8 and is not affected. Customers not using these software versions are not impacted by this vulnerability.

Actions for Institutions Using Ellucian Banner System: Patches for this vulnerability were issued by Ellucian on May 14, 2019 and are included in all subsequent roll-up software releases. There is no indication that student or institutional data has been compromised. The patched vulnerability is extremely difficult to exploit and unlikely to occur outside of a laboratory setting. Institutions running Ellucian Banner Web Tailor versions 8.8.3, 8.8.4 or Banner Enterprise Identity Services versions 8.3, 8.3.1, 8.3.2, and 8.4 should immediately apply the previously release patches.

Fraudulent Admissions Applications:

Although it was reported that attackers can leverage the vulnerability discussed above to create accounts, Ellucian believes this is not correct. The issue described in the alert is not believed to be related to the previously patched Ellucian Banner System vulnerability and is not exclusive to institutions using Ellucian products. Attackers are utilizing bots to submit fraudulent admissions applications and obtain institution email addresses through admission application portals.

Ellucian recommends adding reCAPTCHA capabilities to the admission process to reduce the likelihood of experiencing fraudulent applications for admissions, even if institutions are not currently experiencing this issue.

For More Information:

Ellucian and the Department will continue to review this matter and update stakeholders as necessary. Additional information is available at Ellucian’s Customer Center and in Ellucian’s FAQ document.News TypeAnnouncements