SECURITY UPDATE |  |
| Release Date: | 2014-11-07 (Last update can be found below the document title) |
| Description: | Multiple stored XSS vulnerabilities |
| Criticality Level: | Moderately Critical ( Less Critical < Critical < Moderately Critical < Highly Critical ) |
| Impact: | Insertion of arbitrary HTML code |
| Systems Affected: | Canvas LMS |
| Solution Status: | Patched |
| Discovered By: | Internal audit |
| Relevant Changesets: | fix html escaping on content migrations page · instructure/canvas-lms@08761ca · GitHub |
Summary:
During a routine security audit of the Canvas code base and platform, a number of cross site scripting vulnerabilities were identified. Once identified and confirmed, these vulnerabilities were patched by the Instructure engineering team.
Status:
All systems were patched as of 15:32 MT on 11/6/2014
Jordan has had various roles in the ed tech software (SAAS) industry for the past 9 years. (almost 5 years with Instructure). In his previous company he was a Client Services Manager for two years (responsible for account management, implementation, project management, and training, for each of his customers). After a year and a half he was commissioned to build a training department, all policies and procedures, and deliver training for all customers. Over the past eight years he has been in charge of conceiving, producing and deploying eLearning initiatives and strategies. He has trained over 3,000 adult learners with a wide range of technical aptitude, including K-12 Teachers, Principals, Administrators, Superintendents, Higher Ed Professors, Doctors, CTO’s, and Corporate Business Professionals and Executives. Jordan is an instructional designer and Community Manager for Instructure with a focus on connecting Canvas users with tools and resources that will help them get excited about and become proficient in utilizing the Canvas Learning Platform.
- Reference
- Community Guidelines
- Security
- Developers
- Open Source
