PT-2019-8315 · Edx · Edx-Platform

Publicado 2019-07-30 · Atualizado 2020-01-07 · CVE-2017-18380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2017-08-03

Description The issue allows attackers to trigger password-reset e-mail messages where the reset link has an attacker-controlled domain name. This can be exploited by attackers to potentially gain unauthorized access to user accounts.

Recommendations For versions prior to 2017-08-03, update to a version released after 2017-08-03 to resolve the issue. As a temporary workaround, consider restricting access to the password reset functionality until the update is applied.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2017-18380

Produtos afetados

Edx-Platform

Referências · 5

• https://github.com/edx/edx-platform/pull/15773 · Correção
• https://osv.dev/vulnerability/CVE-2017-18380 · Aviso do Fabricante
• https://groups.google.com/forum/#%21topic/openedx-announce/QTvijt48bAY · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-18380 · Nota de Segurança
• https://t.me/cibsecurity/5803 · Publicação no Telegram