Missing Authorization Affecting xblock-lti-consumer package, versions [7.0.0,7.2.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-XBLOCKLTICONSUMER-3250299
- published 27 Jan 2023
- disclosed 27 Jan 2023
- credit Unknown
Introduced: 27 Jan 2023
CVE-2023-23611 Open this link in a new tabHow to fix?
Upgrade xblock-lti-consumer to version 7.2.2 or higher.
Overview
xblock-lti-consumer is a XBlock that implements the consumer side of the LTI specification
Affected versions of this package are vulnerable to Missing Authorization in the publish_grade_on_score_update() function in signals/signals.py that allows any LTI tool that is integrated with the Open edX platform to post a grade back for any LTI XBlock, using the block location for that XBlock. The code that uploads that score to the LMS grade tables determines which XBlock to upload the grades for by reading the resource_link_id field of the associated line item, which can be controlled by an unauthorized user.