GHSA-3j5x-7ccf-ppgm

Cross-site scripting in recommender-xblock

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-20858

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	recommender-xblock	< 1.3.1	1.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-20858 advisory
https://github.com/edx/RecommenderXBlock/pull/2 web
https://github.com/advisories/GHSA-3j5x-7ccf-ppgm advisory
https://github.com/openedx/RecommenderXBlock package
https://github.com/pypa/advisory-database/tree/main/vulns/recommender-xblock/PYSEC-2019-219.yaml web
https://groups.google.com/forum/#!topic/openedx-announce/SF8Sn6MuUTg web