Security Alert
| Severity: | High |
| Category: | XSS |
| Affected Projects: | edx-platform |
| Reporter: | self-reported |
| Permanent URL: | https://openedx.org/CVE-2015-6960 |
During an internal code-review of the edx-platform code it was discovered that a bug allowed user submitted content to contain JavaScript that would execute in an end-user’s browswer.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2015-6960 to this issue. This is an entry on the CVE list (http://cve.mitre.org), which standardizes names for security problems.
More Information
This bug made it possible for an end user to create a team containing JavaScript code in its name and have this code executed in another user’s browser.
The fix is to correctly escape Javascript in team names before displaying them on the page.
The bug was fixed in this commit.
