| Package | Affected versions | Patched versions |
|---|---|---|
| recommender-xblock | < 1.3.1 | 1.3.1 |
| recommender | < 1.3.1 | 1.3.1 |
Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free