« Volver al listado

CVE-2026-85271

Estado: AplazadaMedia (6.1)—

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py.

Leer descripción completaMostrar menos

Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en títulos de discusión sin sanitizar (CWE-79) en correos digest, permitiendo CSS-markup malicioso para suplantación (phishing) y seguimiento. Requiere UI:R (apertura de correo).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingUser Account ManagementExecution PreventionBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openedx — Open EDX PlatformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-85271",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-85271",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-22T15:51:53.192423Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "openedx",
          "product": "openedx-platform",
          "versions": [
            {
              "status": "affected",
              "version": ">= release/redwood.1, < release/ulmo.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-18T21:18:44.630",
  "references": [
    {
      "url": "https://github.com/openedx/openedx-platform/commit/2af03d21b4142e53e375c7f3699b313e92ec5121",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openedx/openedx-platform/commit/52f2b3bb3e6fac2601c29e8f926c81498d20bb0b",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openedx/openedx-platform/commit/5eae6e51a8797cd3b87cc132f5de73d52561c4d7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openedx/openedx-platform/releases/tag/release/ulmo.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openedx/openedx-platform/releases/tag/release/verawood.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-rv5w-f4r5-h77g",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1."
    }
  ],
  "lastModified": "2026-09-24T21:25:27.050",
  "sourceIdentifier": "security-advisories@github.com"
}