What is CVE-2023-23611?

CVE-2023-23611 is a low-severity missing authorization vulnerability in lti-consumer-xblock (pip), affecting versions >= 7.0.0, < 7.2.2. It is fixed in 7.2.2. The application does not perform an authorization check before performing a sensitive operation.

How severe is CVE-2023-23611?

CVE-2023-23611 has a CVSS score of 3.7 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of lti-consumer-xblock are affected by CVE-2023-23611?

lti-consumer-xblock (pip) versions >= 7.0.0, < 7.2.2 is affected.

Is there a fix for CVE-2023-23611?

Yes. CVE-2023-23611 is fixed in 7.2.2. Upgrade to this version or later.

Is CVE-2023-23611 exploitable, and should I be worried?

Whether CVE-2023-23611 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2023-23611 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2023-23611?

Upgrade lti-consumer-xblock to 7.2.2 or later.

CVE-2023-23611 in lti-consumer-xblock

Q: How severe is CVE-2023-23611?

CVE-2023-23611 has a CVSS score of 3.7 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of lti-consumer-xblock are affected by CVE-2023-23611?

lti-consumer-xblock (pip) versions >= 7.0.0, < 7.2.2 is affected.

Q: Is there a fix for CVE-2023-23611?

Yes. CVE-2023-23611 is fixed in 7.2.2. Upgrade to this version or later.

Q: Is CVE-2023-23611 exploitable, and should I be worried?

Whether CVE-2023-23611 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2023-23611 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2023-23611?

Upgrade lti-consumer-xblock to 7.2.2 or later.

Summary

LTI 1.3 Grade Pass Back Implementation has Missing Authorization Vulnerability

Problem

TL;DR: Any LTI tool that is integrated with on the Open edX platform can
post a grade back for any LTI XBlock so long as it knows or can guess the
block location for that XBlock.

In LTI 1.3, LTI tools can "pass back" scores that learners earn while using
LTI tools to the edX platform. The edX platform then stores those LTI
scores in a separate table. If the right conditions are met, these scores
are then persisted to the LMS grades tables.

LTI tools can create what are called "line items" on the edX platform. A
line item can be thought of as a column in a grade book; it stores results
for a specific activity (i.e. XBlock) for a specific set of users (i.e.
users in the course using the XBlock). A line item has an optional
resource_link_id field, which is basically the XBlock location. An LTI tool
can supply any value for this field.

An LTI tool submits scores to the edX platform for line items. The code
that uploads that score to the LMS grade tables determines which XBlock to
upload the grades for by reading the resource_link_id field of the
associated line item. Because the LTI tool could have submitted any value
for the resource_link_id field, this introduces the potential for a
nefarious LTI tool to submit scores for any LTI XBlock on the platform.

Workarounds

Impact

Any LTI tool that is integrated with on the Open edX platform can post a
grade back for any LTI XBlock so long as it knows the resource_link_id
(i.e. block location) for that XBlock.

The impact is a loss of integrity for LTI XBlock grades.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

CVE-2023-23611 has a CVSS score of 3.7 (Low). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.2.2); upgrading removes the vulnerable code path.

Affected versions

lti-consumer-xblock (>= 7.0.0, < 7.2.2)

Security releases

lti-consumer-xblock → 7.2.2 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

No available patch

Frequently Asked Questions

What is CVE-2023-23611? CVE-2023-23611 is a low-severity missing authorization vulnerability in lti-consumer-xblock (pip), affecting versions >= 7.0.0, < 7.2.2. It is fixed in 7.2.2. The application does not perform an authorization check before performing a sensitive operation.
How severe is CVE-2023-23611? CVE-2023-23611 has a CVSS score of 3.7 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of lti-consumer-xblock are affected by CVE-2023-23611? lti-consumer-xblock (pip) versions >= 7.0.0, < 7.2.2 is affected.
Is there a fix for CVE-2023-23611? Yes. CVE-2023-23611 is fixed in 7.2.2. Upgrade to this version or later.
Is CVE-2023-23611 exploitable, and should I be worried? Whether CVE-2023-23611 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2023-23611 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2023-23611? Upgrade lti-consumer-xblock to 7.2.2 or later.