Security Alert

Severity: High
Category: XSS
Affected Projects: edx-platform
Reporter: self-reported
Permanent URL: https://open.edx.org/CVE-2015-6960

During an internal code-review of the edx-platform code it was discovered that a bug allowed user submitted content to contain JavaScript that would execute in an end-user’s browswer.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2015-6960 to this issue. This is an entry on the CVE list (http://cve.mitre.org), which standardizes names for security problems.

More Information

This bug made it possible for an end user to create a team containing JavaScript code in its name and have this code executed in another user’s browser. 

The fix is to correctly escape Javascript in team names before displaying them on the page.

The bug was fixed in this commit.