CVE-2024-22209 XBlock custom auth does not respect JWT Scopes

Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f...

CVE-2024-22209 XBlock custom auth does not respect JWT Scopes

Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f...

CVE-2024-22209

Open edX Platform suffers an access-control vulnerability where a user with a JWT and limited scopes could call endpoints beyond their authorization. The issue concerns the XBlock custom auth not respecting JWT scopes, enabling elevation of privileges for certain API endpoints. Red Hat, NVD, and ...

PT-2024-19277 · Edx · Open Edx Platform

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions prior to the version containing commit 019888f Description: The issue affects the Open edX Platform, a service-oriented platform for authoring and delivering online learning. A user with a JWT and limited scopes cou...

EDX Open edX Access Control Error Vulnerability

EDX Open edX is an online learning management system from EDX Corporation. An Access Control Error vulnerability exists in Open edX Platform, which stems from the fact that a user with JWT and limited scope can invoke an endpoint that exceeds their access privileges...

CVE-2023-23611

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

Authorization

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

PYSEC-2023-21

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

Open edX 安全漏洞

EDX Open edX is an online learning management system from EDX Corporation, USA. A security vulnerability exists in Open edX XBlock version 7.0.0 to versions prior to 7.2.2, which stems from a lack of authorization management...

CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

CVE-2023-23611

The CVE-2023-23611 entry concerns the LTI Consumer XBlock for Open edX. Affected: LTI Consumer XBlock versions 7.0.0 and above, before 7.2.2. Issue: Missing Authorization allows any integrated LTI tool to post grades for any LTI XBlock by guessing the block location via the resource_link_id, comp...

CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

PT-2023-19073 · Open Edx · Lti Consumer Xblock

Name of the Vulnerable Software and Affected Versions: LTI Consumer XBlock versions 7.0.0 through 7.2.2 Description: The LTI Consumer XBlock implements the consumer side of the LTI specification, enabling integration of third-party LTI provider tools. Any LTI tool integrated with the Open edX...

GHSA-QV6C-367R-3W6Q XBlock vulnerable to Cross-Site Scripting (XSS)

Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...

XBlock vulnerable to Cross-Site Scripting (XSS)

Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...

Drag and Drop XBlock v2 跨站脚本漏洞

Drag and Drop XBlock v2 is an Open edX open source SDK package for online education sites. Implements a drag and drop problem where the learner must drag items to areas on the target image. A cross-site scripting vulnerability exists in Drag and Drop XBlock v2 versions prior to 3.0.0. An attacker...

Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkSky.23 Vulnerability: Remote Stack Buffer Overflow SEH Description: The...

MAL-2022-2672 Malicious code in edx-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a45186001f92d46e485ade8cdd9152dabbe881415b90667398d14c43d98bda4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...