CVE-2017-18380

2019-07-3013:15:13

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.

CPENameOperatorVersion
edx-platformeqhotfix-2016-03-17
edx-platformeqpatch-2016-04-14
edx-platformeqhotfix-2014-01-16
edx-platformeqprod-pre-storage-model
edx-platformeqhotfix-2015-12-09-a
edx-platformeqrelease-2016-03-08
edx-platformeqrelease-2017-05-02-10.39
edx-platformeqrelease-2017-02-21-11.19
edx-platformeqrelease-2017-07-18-11.53
edx-platformeqrelease-2017-04-26-13.19

Name	Operator	Version
edx-platform	eq	hotfix-2016-03-17
edx-platform	eq	patch-2016-04-14
edx-platform	eq	hotfix-2014-01-16
edx-platform	eq	prod-pre-storage-model
edx-platform	eq	hotfix-2015-12-09-a
edx-platform	eq	release-2016-03-08
edx-platform	eq	release-2017-05-02-10.39
edx-platform	eq	release-2017-02-21-11.19
edx-platform	eq	release-2017-07-18-11.53
edx-platform	eq	release-2017-04-26-13.19