VulnerabilityModified
CVE-2023-34831
The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks.
MEDIUM 5.4EPSS 0.45%
Does this matter?
Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.
Description
The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- odysseycs/ithacalabs turnitin lti
- Source
- cve@mitre.org
References
- https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txtExploit, Vendor Advisory
- https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/Broken Link
- https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831/Turnitin_LTI_1.3_HTMLi_CVE-2023-34831.txtExploit, Vendor Advisory
- https://github.com/IthacaLabs/Turnitin/blob/main/Turnitin_Submission_Web_Form/Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.