Executive brief
Overhang Tutor, a tool for deploying the Open edX learning platform, is affected by a security flaw that fails to clear sensitive information from a web browser's memory after a user logs out. This means that if a person uses a shared or public computer, a subsequent user could potentially view the previous person's private account details and personally identifiable information (PII) simply by clicking the browser's 'back' button. This poses a risk to user privacy, particularly in educational or laboratory environments where computers are shared.
Technical details
An information disclosure vulnerability exists in Overhang.IO Tutor (tutor-open-edx) version 20.0.2 and earlier. The application fails to implement proper HTTP Cache-Control headers (such as no-store or no-cache) and lacks sufficient client-side session checks upon logout. A local attacker with physical access to a victim's browser can exploit this by navigating backward in the browser history after a session has ended to view cached pages containing personally identifiable information (PII). This is classified under CWE-524 (Use of Cache Containing Sensitive Information) and CWE-384 (Session Fixation/Improper Session Invalidation). As of the advisory date, no specific patch version has been identified.
Affected products
- Overhang.IO tutor <= 20.0.2
Timeline
- 2025-11-26: advisory: GitHub Advisory and NVD entry published
- 2025-12-01: other: GitHub Advisory reviewed