CVE-2022-46147: Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted.
Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492
The fix is compatible with all Open edX releases newer than Lilac.
Workarounds None.
References https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864
Other sources
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/xblock-drag-and-drop-v2to a version that resolves this vulnerability.Fixed in 3.0.0 - Upgrade
Upgrade
Drag and Drop XBlock v2to a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
What is CVE-2022-46147?
CVE-2022-46147 is a vulnerability in the Drag and Drop XBlock v2 which allows for cross-site scripting in multiple XBlock Fields.
What is the severity of CVE-2022-46147?
CVE-2022-46147 has a severity keyword of 'high' and a severity value of 6.1.
What software versions are affected by CVE-2022-46147?
Versions up to but not including 3.0.0 of the Openedx Xblock-drag-and-drop-v2 software are affected.
How can CVE-2022-46147 be fixed?
To fix CVE-2022-46147, upgrade to version 3.0.0 of the Openedx Xblock-drag-and-drop-v2 software.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-46147?
The Common Weakness Enumeration (CWE) ID for CVE-2022-46147 is 79, which is a flaw in Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').