CVE-2015-2286

State: Published
Severity: Not scored
Published: Mar 19, 2016
Updated: Aug 6, 2024
Reserved: Mar 12, 2015

Description

lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/edx/edx-platform/commit/a1ffcc52594b1e7240501aab0ea145f1da3edb5a
https://open.edx.org/CVE-2015-2286

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.