PT-2022-11791 · Desire2Learn · Desire2Learn/D2L Brightspace+1

Published 2022-04-19 · Updated 2023-08-08 · CVE-2021-43129

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Desire2Learn/D2L Learning Management System (LMS) version 20.21.7

Description A bypass exists in the quizzing feature of Desire2Learn/D2L Brightspace, allowing a quiz-taker to access print and copy functionality via the browser's right click menu even when the "Disable Right Click" option is enabled. This is due to an Access Control issue that enables a remote malicious user to disable the "Disable right click" control.

Recommendations For version 20.21.7, consider disabling the quizzing feature temporarily until a patch is available to prevent exploitation of the Access Control vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-43129

Affected Products

Desire2Learn/D2L Brightspace

Desire2Learn/D2L Learning Management System

References · 8

• 🔥 https://github.com/Skotizo/CVE-2021-43129 · Exploit
• https://osv.dev/vulnerability/CVE-2021-43129 · Vendor Advisory
• https://d2l.com/learning-management-system-lms · Vendor Advisory
• https://community.brightspace.com/s/article/retirement-notice-disable-right-click · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43129 · Security Note
• https://t.me/cibsecurity/41094 · Telegram Post
• https://t.me/cvenotify/29149 · Telegram Post
• https://t.me/cvenotify/29437 · Telegram Post