Vulnerabilities

TI-2024-14802 CVE-2024-22209

XBlock custom auth does not respect JWT Scopes

MEDIUM 41

Open edX Platform is a service-oriented platform for authoring and delivering online learning.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00574 Published 2024-01-13 No fix listed CWE-284

TI-2022-13908 CVE-2022-32195 · GHSA-r5xm-9894-gpw6

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.

LOW 32

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02345 Published 2022-06-09 No fix listed CWE-79

TI-2021-16633 CVE-2021-39248 · GHSA-cxfc-hq29-wmm6

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via…

LOW 28

Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00624 Published 2021-08-17 No fix listed CWE-79

TI-2020-10329 CVE-2020-13145 · GHSA-hr85-6hw5-vqgh

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File…

LOW 25

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2020-05-18 No fix listed CWE-79

TI-2020-10330 CVE-2020-13146 · GHSA-55p9-927h-wfvq

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in…

MEDIUM 40

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0109 Published 2020-05-18 No fix listed CWE-1236

TI-2020-10328 CVE-2020-13144 · GHSA-hc63-fv38-p9mv

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the…

MEDIUM 51

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" sc…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.10963 Published 2020-05-18 No fix listed CWE-862

TI-2019-14733 CVE-2019-20513 · GHSA-2q2x-qfwg-f3pw

Open edX Ironwood.1 allows support/certificates?user= reflected XSS.

LOW 28

Open edX Ironwood.1 allows support/certificates?user= reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0049 Published 2020-03-19 No fix listed CWE-79

TI-2018-14820 CVE-2018-20858 · GHSA-3j5x-7ccf-ppgm

Recommender before 2018-07-18 allows XSS.

LOW 29

Recommender before 2018-07-18 allows XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00855 Published 2019-08-09 Fixed in 1.3.1 CWE-79

TI-2018-14821 CVE-2018-20859 · GHSA-mrv2-vg67-g8pw

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

LOW 30

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01202 Published 2019-07-30 No fix listed CWE-79

TI-2017-13554 CVE-2017-18381 · GHSA-5h6g-ggx5-rwfh

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to…

LOW 34

The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01165 Published 2019-07-30 No fix listed

TI-2017-13553 CVE-2017-18380 · GHSA-wpqp-m96m-3rw2

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages…

LOW 35

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01079 Published 2019-07-30 No fix listed CWE-284

TI-2016-08804 CVE-2016-10766 · GHSA-6hr3-48xj-g486

edx-platform before 2016-06-06 allows CSRF.

LOW 39

edx-platform before 2016-06-06 allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00604 Published 2019-07-29 No fix listed CWE-352

TI-2016-08803 CVE-2016-10765 · GHSA-j8c9-g3mj-8r24

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

LOW 25

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0076 Published 2019-07-29 No fix listed CWE-20

TI-2015-04720 CVE-2015-5601 · GHSA-x9r5-6wwv-rqw2

edx-platform before 2015-07-20 allows code execution by privileged users because the…

MEDIUM 41

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0149 Published 2019-07-29 No fix listed CWE-434

TI-2015-05245 CVE-2015-6253 · GHSA-q6g3-59fv-v7rg

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

LOW 25

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0053 Published 2019-07-29 No fix listed CWE-79

TI-2015-05798 CVE-2015-6960 · GHSA-pjxc-44cf-qvq5

edx-platform before 2015-09-17 allows XSS via a team name.

LOW 28

edx-platform before 2015-09-17 allows XSS via a team name.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2019-07-29 No fix listed CWE-79

TI-2015-01949 CVE-2015-2186 · GHSA-hxqf-qqgc-653f

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof…

LOW 35

The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0111 Published 2018-02-03 No fix listed CWE-20

TI-2015-05589 CVE-2015-6671 · GHSA-fccm-7qh8-2456

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML…

LOW 28

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a databa…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0089 Published 2017-03-13 No fix listed CWE-200

TI-2015-02022 CVE-2015-2286 · GHSA-fgmr-7xcr-rjr8

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not…

LOW 33

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by r…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.02047 Published 2016-03-19 No fix listed CWE-200

Vulnerabilities

Filters