Vulnerabilities

TI-2022-13908 CVE-2022-32195 · GHSA-r5xm-9894-gpw6

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.

LOW 32

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02345 Published 2022-06-09 No fix listed CWE-79

TI-2019-14733 CVE-2019-20513 · GHSA-2q2x-qfwg-f3pw

Open edX Ironwood.1 allows support/certificates?user= reflected XSS.

LOW 28

Open edX Ironwood.1 allows support/certificates?user= reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0049 Published 2020-03-19 No fix listed CWE-79

TI-2015-02022 CVE-2015-2286 · GHSA-fgmr-7xcr-rjr8

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not…

LOW 33

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by r…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02047 Published 2016-03-19 No fix listed CWE-200

Vulnerabilities

Filters

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.

Open edX Ironwood.1 allows support/certificates?user= reflected XSS.

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not…