PT-2017-7047 · Edx · Edx-Platform

Publicado 2017-03-13 · Atualizado 2020-01-07 · CVE-2015-6671

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-08-25

Description The issue allows context-dependent attackers to obtain sensitive information by leveraging access to a database backup, as the database is used for storage of SAML SSO secrets.

Recommendations For versions prior to 2015-08-25, update to a version that does not require the use of the database for storage of SAML SSO secrets to mitigate the risk of sensitive information disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-6671

Produtos afetados

Edx-Platform

Referências · 3

• https://github.com/edx/edx-platform/pull/9471 · Correção
• https://open.edx.org/CVE-2015-6671 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6671 · Nota de Segurança