Openedx
CVE-2024-43782
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.
AnalysisAI
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-74. This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings. Affected products include: Openedx.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target
Server-side request forgery (SSRF) in Open edX Platform allows authenticated Enterprise Admin users to force the applica
Missing authorization on the `set_course_mode_price()` instructor endpoint in Open edX Platform allows any authenticated
Server-Side Request Forgery with full response exfiltration in Open edX Platform's Studio CMS video download endpoint al
Open edX Platform versions prior to commit 76462f1e5fa9b37d2621ad7ad19514b403908970 suffer from an open redirect vulnera
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provid
Open edX Platform from maple release through ulmo allows unauthenticated attackers to bypass email verification by explo
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI
Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CS
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today