| Package | Affected versions | Patched versions |
|---|---|---|
| canvas learning management service | < 2022-10-15 | 2022-10-15 |
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free