194 matches found
CVE-2024-22209 XBlock custom auth does not respect JWT Scopes
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f...
PT-2024-19277 · Edx · Open Edx Platform
Name of the Vulnerable Software and Affected Versions: Open edX Platform versions prior to the version containing commit 019888f Description: The issue affects the Open edX Platform, a service-oriented platform for authoring and delivering online learning. A user with a JWT and limited scopes cou...
EDX Open edX Access Control Error Vulnerability
EDX Open edX is an online learning management system from EDX Corporation. An Access Control Error vulnerability exists in Open edX Platform, which stems from the fact that a user with JWT and limited scope can invoke an endpoint that exceeds their access privileges...
CVE-2023-23611
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
Authorization
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
PYSEC-2023-21
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
Open edX 安全漏洞
EDX Open edX is an online learning management system from EDX Corporation, USA. A security vulnerability exists in Open edX XBlock version 7.0.0 to versions prior to 7.2.2, which stems from a lack of authorization management...
CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
CVE-2023-23611
The CVE-2023-23611 entry concerns the LTI Consumer XBlock for Open edX. Affected: LTI Consumer XBlock versions 7.0.0 and above, before 7.2.2. Issue: Missing Authorization allows any integrated LTI tool to post grades for any LTI XBlock by guessing the block location via the resource_link_id, comp...
CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
PT-2023-19073 · Open Edx · Lti Consumer Xblock
Name of the Vulnerable Software and Affected Versions: LTI Consumer XBlock versions 7.0.0 through 7.2.2 Description: The LTI Consumer XBlock implements the consumer side of the LTI specification, enabling integration of third-party LTI provider tools. Any LTI tool integrated with the Open edX...
XBlock vulnerable to Cross-Site Scripting (XSS)
Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...
GHSA-QV6C-367R-3W6Q XBlock vulnerable to Cross-Site Scripting (XSS)
Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...
Drag and Drop XBlock v2 跨站脚本漏洞
Drag and Drop XBlock v2 is an Open edX open source SDK package for online education sites. Implements a drag and drop problem where the learner must drag items to areas on the target image. A cross-site scripting vulnerability exists in Drag and Drop XBlock v2 versions prior to 3.0.0. An attacker...
CVE-2022-32195
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...
CVE-2022-32195
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...
CVE-2022-32195
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...
Design/Logic Flaw
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...
CVE-2022-32195
Open edX platforms released before 2022-06-06 are vulnerable to a cross-site scripting (XSS) flaw via the next parameter in the logout URL. The issue is reflected XSS affecting the logout flow, enabling injected scripts to execute in users’ browsers on pages that read the next parameter. The CVSS...
