Improper Link Restriction on Password-Reset Page in Open edX edx-platform

Improper Link Restriction on Password-Reset Page in Open edX edx-platform

CVE-2015-2286 · MEDIUM Severity

AV:N/AC:M/AU:N/C:P/I:N/A:N

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.

Learn more about our Social Engineering.