PT-2022-27763 · Unknown · Drag/Drop Xblock

Feanil · Published 2022-11-28 · Updated 2022-12-02 · CVE-2022-46147

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drag and Drop XBlock v2 versions prior to 3.0.0

Description The issue affects the Drag and Drop XBlock v2, which implements a drag-and-drop style problem. It is vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted.

Recommendations For versions prior to 3.0.0, update to version 3.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable XBlock Fields until the patch is applied. There are no known workarounds for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2022-46147

GHSA-QV6C-367R-3W6Q

PYSEC-2022-43175

Affected Products

Drag/Drop Xblock

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46147.json · Exploit
• 🔥 https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864 · Exploit
• https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a · Patch
• https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0 · Patch
• https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46147 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46147 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qv6c-367r-3w6q · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43175 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/xblock-drag-and-drop-v2/PYSEC-2022-43175.yaml · Note
• https://github.com/openedx/xblock-drag-and-drop-v2 · Note
• https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 · Note
• https://t.me/cibsecurity/53613 · Telegram Post