CVE-2024-22209 — XBlock custom auth does not respect JWT Scopes
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their acc…
Published: 2024-01-13 · CVSS: 6.4 · CVSS 3.1
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7