PT-2018-4362 · Edx · Edx Configuration Repo

Published 2018-02-03 · Updated 2018-03-02 · CVE-2015-2186

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions edx Configuration Repo (affected versions not specified)

Description The issue allows remote websites to spoof edX accounts by leveraging the use of the string literal "False" instead of a boolean False for the CORS ORIGIN ALLOW ALL setting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-2186

Affected Products

Edx Configuration Repo

References · 3

• https://github.com/edx/configuration/pull/1885/files · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-2186 · Security Note
• https://open.edx.org/CVE-2015-2186 · Vendor Advisory