{"action":"Upgrade xblock-drag-and-drop-v2 to 3.0.0 or later.","affected":[{"fixed":"3.0.0","introduced":"0"}],"component":"xblock-drag-and-drop-v2","cve_ids":["CVE-2022-46147"],"ecosystem":"PyPI","epss":0.0086,"exploited":false,"fixed_versions":["3.0.0"],"ghsa_id":"GHSA-qv6c-367r-3w6q","id":"tcs_01M5KGHW1NPVXZH71YTDFKPT0K","modified_at":"2024-11-21T14:57:16.331303Z","published_at":"2022-11-28T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-43175","https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q","https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864","https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0","https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2022-43175","url":"https://osv.dev/vulnerability/PYSEC-2022-43175"}],"summary":"Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multip"}