CyberRota Analysis
AI-GeneratedThe Open edX LMS platform's LTI Provider implementation is vulnerable due to inadequate validation of OAuth nonces and timestamps, allowing attackers to replay valid LTI launch requests indefinitely. This could lead to unauthorized access to learning resources and potential data breaches. Organizations utilizing Open edX for online learning should prioritize applying the patch from commit 3a5ac85 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.