CVE-2015-2186: Input Validation
The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORSORIGINALLOWALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2186?
CVE-2015-2186 is considered a moderate severity vulnerability.
How do I fix CVE-2015-2186?
To fix CVE-2015-2186, ensure that the CORS_ORIGIN_ALLOW_ALL setting uses a boolean value instead of the string literal 'False'.
Which software versions are affected by CVE-2015-2186?
CVE-2015-2186 affects versions of edX Configuration up to 1.0 and edX Open edX Platform up to 1.6.0.
Is CVE-2015-2186 still a concern in the latest versions of edX software?
No, CVE-2015-2186 was fixed on March 6, 2015, in the subsequent releases of the software.
What type of attack does CVE-2015-2186 enable?
CVE-2015-2186 allows remote websites to spoof edX accounts by exploiting improper handling of the CORS_ORIGIN_ALLOW_ALL setting.