CVE-2024-22209
XBlock custom auth does not respect JWT Scopes
Résumé
XBlock custom auth does not respect JWT Scopes
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com