Description
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Unscored
CVE-2021-36539
EUVD-2021-23141GHSA-pw89-gxgv-mjvm
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file p…
Published Jan 26, 2023 · Updated Aug 4, 2024 · Assigned by mitre