XBlock custom auth does not respect JWT Scopes
CVE-2024-22209

6.4MEDIUM

Key Information:

Vendor

Openedx

Status
Edx-platform
Vendor
CVE Published:
13 January 2024

What is CVE-2024-22209?

Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.

Affected Version(s)

edx-platform < commit 019888f

References

https://github.com/openedx/edx-platform/security/advisori...
x_refsource_CONFIRM
https://github.com/openedx/edx-platform/commit/019888f3d1...
x_refsource_MISC
https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-22209 : XBlock custom auth does not respect JWT Scopes