instructure records
2 published records for vendor instructure.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-639 Authorization Bypass Through User-Controlled Key1
- CWE-918 Server-Side Request Forgery (SSRF)1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
2 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
26Monitor | CVE-2021-36539No exploit | Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file prinstructure · canvas learning management service · CWE-639 | Medium6.5 | — | 0.8% | Jan 26, 2023 |
25Monitor | CVE-2020-5775Proof of concept | Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTinstructure · canvas learning management service · CWE-918 | Medium5.8 | — | 6.5% | Aug 21, 2020 |
- CVE-2021-3653926Monitor
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file pr
MediumCVSS 6.5No exploitEPSS 0%instructure · canvas learning management serviceJan 26, 2023
- CVE-2020-577525Monitor
Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HT
MediumCVSS 5.8Proof of conceptEPSS 6%instructure · canvas learning management serviceAug 21, 2020