GitHub Advisoryadvisory · PyPI

GHSA-3j5x-7ccf-ppgm Cross-site scripting in recommender-xblock

MEDIUM Published 2019-08-21 Modified 2024-10-26 Official page ↗
Aliases
CVE-2018-20858
Ecosystem
PyPI
Packages
recommender-xblock
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-08-21

Affected packages

• PyPI recommender-xblock: < 1.3.1 → fixed in 1.3.1

Description

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource.

Related

Alias · CVE (1)

  • CVE-2018-20858 Recommender before 2018-07-18 allows XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References