CVE-2023-34831

Summary

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/
• https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/
• https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txt

• ←Previous
• Next→