Open edX安全警告: XSS Vulnerability in Teams Feature

Security Alert

Severity: High
Category: XSS
Affected Projects: edx-platform
Reporter: self-reported
Permanent URL: https://open.edx.org/CVE-2015-6960

During an internal code-review of the edx-platform code it was discovered that a bug allowed user submitted content to contain JavaScript that would execute in an end-user’s browswer.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2015-6960 to this issue. This is an entry on the CVE list (http://cve.mitre.org), which standardizes names for security problems.

More Information

This bug made it possible for an end user to create a team containing JavaScript code in its name and have this code executed in another user’s browser.

The fix is to correctly escape Javascript in team names before displaying them on the page.

The bug was fixed in this commit.

Posted in Open edX.

edustack

edustack webmaster

发表评论

电子邮件地址不会被公开。 必填项已用*标注

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据