Executive brief
recommender-xblock is an Open edX component that allows instructors to recommend learning resources to students. A vulnerability allows learners to craft malicious resources containing JavaScript code that executes when staff members view the recommendation, potentially stealing their credentials or performing actions on their behalf.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in recommender-xblock versions before 1.3.1. An attacker can craft a fake resource with embedded JavaScript that is stored in the system and executed in the browser of staff members who view the recommended resource. The attack requires social engineering (luring staff to view a malicious recommendation) but no authentication. A successful exploit could allow credential theft or session hijacking. The fix was released in version 1.3.1.
Affected products
- Open edX recommender-xblock before 1.3.1
Timeline
- 2019-08-09: disclosed: CVE-2018-20858 published by NVD
- 2019-08-21: advisory: GHSA-3j5x-7ccf-ppgm published
- 2018-07-18: patched: Fix merged in version 1.3.1