TI-2024-14802 CVE-2024-22209
XBlock custom auth does not respect JWT Scopes
Priority MEDIUM 41
Open edX Platform is a service-oriented platform for authoring and delivering online learning.
Vulnerabilities
12 records
TI-2021-16633 CVE-2021-39248 · GHSA-cxfc-hq29-wmm6
Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via…
Priority LOW 28
Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
TI-2018-14821 CVE-2018-20859 · GHSA-mrv2-vg67-g8pw
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
Priority LOW 30
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
TI-2017-13554 CVE-2017-18381 · GHSA-5h6g-ggx5-rwfh
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to…
Priority LOW 34
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
TI-2017-13553 CVE-2017-18380 · GHSA-wpqp-m96m-3rw2
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages…
Priority LOW 35
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
TI-2016-08804 CVE-2016-10766 · GHSA-6hr3-48xj-g486
edx-platform before 2016-06-06 allows CSRF.
Priority LOW 39
edx-platform before 2016-06-06 allows CSRF.
TI-2016-08803 CVE-2016-10765 · GHSA-j8c9-g3mj-8r24
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
Priority LOW 25
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
TI-2015-04720 CVE-2015-5601 · GHSA-x9r5-6wwv-rqw2
edx-platform before 2015-07-20 allows code execution by privileged users because the…
Priority MEDIUM 41
edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
TI-2015-05245 CVE-2015-6253 · GHSA-q6g3-59fv-v7rg
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
Priority LOW 25
edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
TI-2015-05798 CVE-2015-6960 · GHSA-pjxc-44cf-qvq5
edx-platform before 2015-09-17 allows XSS via a team name.
Priority LOW 28
edx-platform before 2015-09-17 allows XSS via a team name.
TI-2015-01949 CVE-2015-2186 · GHSA-hxqf-qqgc-653f
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof…
Priority LOW 35
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting.
TI-2015-05589 CVE-2015-6671 · GHSA-fccm-7qh8-2456
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML…
Priority LOW 28
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a databa…