gaukas/instructure-canvas-file-oracle

gaukas/instructure-canvas-file-oracle

GitHubGitHub
GitHubgithub.com
Releases0
Stars1
Gain access to any uploaded files in your class via DocViewer using an exploitation in Canvas API v1.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2021-36539↗
6.5 MEDIUM—

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).