PT-2019-8315 · Edx · Edx-Platform

Published 2019-07-30 · Updated 2020-01-07 · CVE-2017-18380

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2017-08-03

Description The issue allows attackers to trigger password-reset e-mail messages where the reset link has an attacker-controlled domain name. This can be exploited by attackers to potentially gain unauthorized access to user accounts.

Recommendations For versions prior to 2017-08-03, update to a version released after 2017-08-03 to resolve the issue. As a temporary workaround, consider restricting access to the password reset functionality until the update is applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2017-18380

Affected Products

Edx-Platform

References · 5

• https://github.com/edx/edx-platform/pull/15773 · Patch
• https://osv.dev/vulnerability/CVE-2017-18380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18380 · Security Note
• https://groups.google.com/forum/#%21topic/openedx-announce/QTvijt48bAY · Note
• https://t.me/cibsecurity/5803 · Telegram Post