Oppia
Monthly
Missing authorization on Oppia's AdminRoleHandler GET endpoint (through v3.5.2) exposes privileged account enumeration to any registered user. The endpoint in core/controllers/admin.py is decorated with open_access instead of an admin-only access control decorator, allowing authenticated non-admin users to query filter_criterion parameters and retrieve usernames holding specific roles, banned-user flags, and managed topic identifiers. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the organizational structure disclosure it enables facilitates targeted follow-on attacks against administrative accounts.
Oppia is an online learning platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Missing authorization on Oppia's AdminRoleHandler GET endpoint (through v3.5.2) exposes privileged account enumeration to any registered user. The endpoint in core/controllers/admin.py is decorated with open_access instead of an admin-only access control decorator, allowing authenticated non-admin users to query filter_criterion parameters and retrieve usernames holding specific roles, banned-user flags, and managed topic identifiers. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the organizational structure disclosure it enables facilitates targeted follow-on attacks against administrative accounts.
Oppia is an online learning platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.