Edx

Records19All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Edx records in CISA KEV

No Edx vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Edx-platform 12 records MEDIUM Open Edx 3 records LOW Open Edx Platform 3 records MEDIUM Configuration 1 record LOW Recommender 1 record LOW

Records

12 records in Edx-platform · all components

TI-2024-14802 CVE-2024-22209

XBlock custom auth does not respect JWT Scopes

MEDIUM 41

Open edX Platform is a service-oriented platform for authoring and delivering online learning.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00574 Published 2024-01-13 No fix listed CWE-284

TI-2015-04720 CVE-2015-5601 · GHSA-x9r5-6wwv-rqw2

edx-platform before 2015-07-20 allows code execution by privileged users because the…

MEDIUM 41

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0149 Published 2019-07-29 No fix listed CWE-434

TI-2016-08804 CVE-2016-10766 · GHSA-6hr3-48xj-g486

edx-platform before 2016-06-06 allows CSRF.

LOW 39

edx-platform before 2016-06-06 allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00604 Published 2019-07-29 No fix listed CWE-352

TI-2017-13553 CVE-2017-18380 · GHSA-wpqp-m96m-3rw2

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages…

LOW 35

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01079 Published 2019-07-30 No fix listed CWE-284

TI-2015-01949 CVE-2015-2186 · GHSA-hxqf-qqgc-653f

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof…

LOW 35

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0111 Published 2018-02-03 No fix listed CWE-20

TI-2017-13554 CVE-2017-18381 · GHSA-5h6g-ggx5-rwfh

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to…

LOW 34

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01165 Published 2019-07-30 No fix listed

TI-2018-14821 CVE-2018-20859 · GHSA-mrv2-vg67-g8pw

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

LOW 30

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01202 Published 2019-07-30 No fix listed CWE-79

TI-2021-16633 CVE-2021-39248 · GHSA-cxfc-hq29-wmm6

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via…

LOW 28

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00624 Published 2021-08-17 No fix listed CWE-79

TI-2015-05798 CVE-2015-6960 · GHSA-pjxc-44cf-qvq5

edx-platform before 2015-09-17 allows XSS via a team name.

LOW 28

edx-platform before 2015-09-17 allows XSS via a team name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2019-07-29 No fix listed CWE-79

TI-2015-05589 CVE-2015-6671 · GHSA-fccm-7qh8-2456

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML…

LOW 28

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a databa…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0089 Published 2017-03-13 No fix listed CWE-200

TI-2016-08803 CVE-2016-10765 · GHSA-j8c9-g3mj-8r24

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

LOW 25

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0076 Published 2019-07-29 No fix listed CWE-20

TI-2015-05245 CVE-2015-6253 · GHSA-q6g3-59fv-v7rg

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

LOW 25

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2019-07-29 No fix listed CWE-79

Open these records in search →