CVE-2023-34831
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The 'Submission Web Form' of the Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form where students submit their reports for similarity/plagiarism checks.
Risk Assessment
HTML Injection attacks can lead to the injection of malicious code, threatening data integrity and user security. This may also result in information leakage or other serious consequences for the organization.
Recommendation
It is recommended to update the Turnitin LTI tool/plugin to the latest version to eliminate the vulnerability. Additionally, implementing input validation and sanitization mechanisms in forms is advisable.
Original NVD description (English source)
The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.