GitHub Advisoryadvisory · PyPI

GHSA-qv6c-367r-3w6q XBlock vulnerable to Cross-Site Scripting (XSS)

HIGH Published 2022-12-02 Modified 2024-11-22 Official page ↗
Aliases
CVE-2022-46147
Ecosystem
PyPI
Packages
xblock-drag-and-drop-v2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-79, CWE-80
Reviewed
2022-12-02

Affected packages

• PyPI xblock-drag-and-drop-v2: < 3.0.0 → fixed in 3.0.0

Description

Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds None. References https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864

Related

Alias · CVE (1)

  • CVE-2022-46147 Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References