CVE-2018-20858

Name of the Vulnerable Software and Affected Versions: Recommender versions prior to 1.3.1

Description: The issue allows for cross-site scripting (XSS), which can be exploited by a learner crafting a fake resource that includes a script. This script could potentially steal credentials from staff if they are lured into viewing the recommended resource.

Recommendations: For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the recommender feature until a patch is available. Avoid using the recommender feature with untrusted resources to minimize the risk of exploitation.