Vulnerabilities

TI-2022-18576 CVE-2022-39196 · GHSA-vh3p-2r9j-rvfc

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by…

LOW 32

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01444 Published 2022-09-04 No fix listed

TI-2021-14871 CVE-2021-36746 · GHSA-65hj-758h-86mr

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.

LOW 25

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00565 Published 2021-07-20 No fix listed CWE-79

TI-2021-14872 CVE-2021-36747 · GHSA-42mm-xxc6-g629

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.

LOW 25

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0062 Published 2021-07-20 No fix listed CWE-79

TI-2020-07228 CVE-2020-9008 · GHSA-hf77-c8vc-7pmp

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1…

LOW 25

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00617 Published 2020-02-25 No fix listed CWE-79

TI-2018-09525 CVE-2018-13257 · GHSA-mjpp-cj33-843w

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is…

LOW 30

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing att…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0121 Published 2019-11-18 No fix listed CWE-601

TI-2017-13447 CVE-2017-18262 · GHSA-946w-mjq8-xx28

Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects…

LOW 30

Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibbolet…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0139 Published 2018-04-30 No fix listed CWE-20

Vulnerabilities

Filters

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by…

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1…

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is…

Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects…