medium6.5
CVE-2021-36539
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc…
Impact
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Instructure | Canvas Learning Management Service | before 2022-10-15 |