CVE-2024-43782

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437837.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2024-437845.7lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials t CVE-2024-437852.5gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the CVE-2024-437875.0Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Con CVE-2024-437886.1Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, CVE-2024-437894.3Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them al CVE-2024-43795.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in CVE-2024-437905.5Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), CVE-2024-437917.8RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning CVE-2024-437926.1Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. CVE-2024-437936.4Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. CVE-2024-437946.1OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Impr