What’s Vulnerable › Vulnerabilities

CVE-2018-20859

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-30 · updated 2026-06-17
• Weakness: CWE-79

Description

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

Affected products

• openedx edx-platform: before 2018-07-18 — fixed in 2018-07-18

How to fix

Upgrade to a fixed version: openedx edx-platform 2018-07-18. Check the vendor advisory for mitigations.

References

• https://github.com/edx/edx-platform/commit/5b144559fbdba7ff673cc1c165aa2d343e07b6bd.patch
• https://groups.google.com/forum/#%21topic/openedx-announce/wsm5mtUhhME
• https://patch-diff.githubusercontent.com/raw/edx/edx-platform/pull/18639.patch
• https://github.com/edx/edx-platform/commit/5b144559fbdba7ff673cc1c165aa2d343e07b6bd.patch
• https://groups.google.com/forum/#%21topic/openedx-announce/wsm5mtUhhME
• https://patch-diff.githubusercontent.com/raw/edx/edx-platform/pull/18639.patch

Get alerted when CVE-2018-20859 or the next vulnerability affects your stack