CVE-2022-46147 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields
Attackers can inject malicious scripts into drag-and-drop XBlock fields, potentially compromising user sessions on Open edX platforms.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-46147?
CVE-2022-46147 is a high-severity cross-site scripting vulnerability in openedx xblock-drag-and-drop-v2, published on 28 Nov 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
Weakness: CWE-79
Which versions are affected by CVE-2022-46147?
3 open source packages ship an affected version, including xblock-drag-and-drop-v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xblock-drag-and-drop-v2 PyPI | All versions | 3.0.0 |
xblock-drag-and-drop-v2 PyPI | All versions | 3.0.0 |
xblock-drag-and-drop-v2 PyPI | All versions | 3.0.0 |
Products include Openedx Xblock-Drag-and-Drop-V2.
How do I fix CVE-2022-46147?
Upgrade xblock-drag-and-drop-v2 to 3.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-46147 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-46147 exists.
Sources
Also known as GHSA-qv6c-367r-3w6q, PYSEC-2022-43175.