CVE-2023-34831

Опубликовано: 29 июн. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.

Ссылки

https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt
Exploit
Vendor Advisory
https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/
Broken Link
https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt
Exploit
Vendor Advisory
https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:odysseycs:ithacalabs_turnitin_lti:1.3:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00623

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-3gr2-64gm-h536