CVE-2015-2286

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-01-29

Description The issue concerns a problem with the password-reset page, where links are not properly restricted. This allows attackers to discover password-reset tokens by reading a referer log after a victim navigates from the password-reset page to a social-sharing site.

Recommendations For versions prior to 2015-01-29, update to a version released after 2015-01-29 to resolve the issue.