Oppia
by Oppia
CVEs (2)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-40021 | Med | 0.00 | 5.3 | 0.01 | Aug 16, 2023 | Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-force the expected CSRF… | ||
| CVE-2021-41733 | Med | 0.00 | 6.1 | 0.01 | Nov 8, 2021 | Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. |
- risk 0.00cvss 5.3epss 0.01
Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is not safe against timing attacks. By repeatedly submitting invalid tokens, an attacker can brute-force the expected CSRF…
- risk 0.00cvss 6.1epss 0.01
Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.