Staging Environment: Content and features may be unstable or change without notice.

Advisory Severity Curation

CVE-2022-46147

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-qv6c-367r-3w6q

XBlock vulnerable to Cross-Site Scripting (XSS) ### Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. ### Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. ### Workarounds None. ### References https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864

gitlab/pypi/xblock-drag-and-drop-v2/CVE-2022-46147

XBlock vulnerable to Cross-Site Scripting (XSS) XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted.

pypa/xblock-drag-and-drop-v2/PYSEC-2022-43175

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.

pysec/PYSEC-2022-43175

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.