{"id":"PYSEC-2022-43175","details":"Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.","aliases":["CVE-2022-46147","GHSA-qv6c-367r-3w6q"],"modified":"2024-11-21T14:57:16.331303Z","published":"2022-11-28T21:15:00Z","references":[{"type":"ADVISORY","url":"https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q"},{"type":"WEB","url":"https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864"},{"type":"WEB","url":"https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0"},{"type":"FIX","url":"https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a"}],"affected":[{"package":{"name":"xblock-drag-and-drop-v2","ecosystem":"PyPI","purl":"pkg:pypi/xblock-drag-and-drop-v2"},"ranges":[{"type":"GIT","repo":"https://github.com/openedx/xblock-drag-and-drop-v2","events":[{"introduced":"0"},{"fixed":"68887d1b4a44325d2de7573d450e41129ba98b1a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"versions":["2.5.0","2.7.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/xblock-drag-and-drop-v2/PYSEC-2022-43175.yaml"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}