PT-2023-25018 · Turnitin · Turnitin Lti Tool

Published 2023-06-29 · Updated 2023-07-06 · CVE-2023-34831

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Turnitin LTI tool/plugin version 1.3

Description The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is vulnerable to HTML Injection attacks, which involve the id and title HTTP POST parameters.

Recommendations For version 1.3, consider restricting access to the submission web form until a fix is available, or avoid using the id and title parameters in the affected HTTP POST requests to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-34831

Affected Products

Turnitin Lti Tool

References · 4

• 🔥 https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-34831 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34831 · Vendor Advisory
• https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form · Note