Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.8%
probabilidad de explotación
0.8%top 44% de las CVE
explotación observada
noninguna fuente lo reporta
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Productos afectados
openedx · xblock-drag-and-drop-v2Referencias
https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1ahttps://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q