Products
Open edX
Source
security-advisories@github.com
Tags
CVE-2024-43782 details
Last Modified : Aug. 23, 2024, 4:18 p.m.
Description
This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
7.7
Exploitability Score
1.3
Impact Score
5.8
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
References
| URL | Source |
|---|---|
| https://github.com/openedx/openedx-translations/commit/3c4093705dec99590577c4d8270ce263f7fffc5a | security-advisories@github.com |
| https://github.com/openedx/openedx-translations/commit/b2444340e8702c7955310331c1db5fd85b25b92b | security-advisories@github.com |
| https://github.com/openedx/openedx-translations/security/advisories/GHSA-fg8c-2pvj-wx3j | security-advisories@github.com |