CVE-2024-22209: XBlock custom auth does not respect JWT Scopes
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 019888f
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22209?
CVE-2024-22209 has a moderate severity level, as it allows users to access endpoints beyond their intended permissions.
How do I fix CVE-2024-22209?
To fix CVE-2024-22209, update the edX platform to a version released after January 12, 2024.
What types of endpoints are affected by CVE-2024-22209?
CVE-2024-22209 affects various service endpoints that do not properly enforce user permissions based on the JWT scope.
Who is impacted by CVE-2024-22209?
Users with JWT tokens and limited scopes are the primary group impacted by CVE-2024-22209.
What version of edX platform is safe from CVE-2024-22209?
The edX platform versions released after January 12, 2024, are considered safe from CVE-2024-22209.