Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.8%
probabilidade de exploração
0.8%top 44% das CVEs
exploração observada
nãonenhuma fonte reporta
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
openedx · xblock-drag-and-drop-v2Referências
https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1ahttps://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q