Security readout for executives and security teams
Plain-English summary
CVE-2021-36747 is an authenticated cross-site scripting issue in Blackboard Learn through 9.1, tied to the Feedback to Learner form. A logged-in user may be able to cause script to run in another user's browser. Public sources provided do not include a CVSS score, vendor fix, or confirmed exploitation.
Executive priority
Treat this as a targeted platform-risk item, not an internet-wide emergency. Prioritize confirmation if Blackboard Learn 9.1 is still used, especially where many semi-trusted users can submit feedback viewed by instructors or administrators.
Technical view
The CVE record describes XSS in Blackboard Learn through 9.1 via the Feedback to Learner form by an authenticated user. The source bundle does not specify stored versus reflected behavior, affected builds beyond 9.1, required privileges, impact scope, or remediation details. KEV status is false.
Likely exposure
Exposure is limited to organizations running Blackboard Learn through 9.1 where authenticated users can access the Feedback to Learner workflow. Internet-facing education portals with many student, instructor, or staff accounts should treat exposure as plausible until version and configuration are confirmed.
Exploitation context
The bundle references a public GitHub page, but provides no KEV listing and no cited evidence of active exploitation. Because exploitation requires authentication, risk depends heavily on account population, role permissions, and whether submitted feedback is viewed by higher-privilege users.
Researcher notes
Evidence is sparse. The CVE text identifies authenticated XSS through a specific Blackboard Learn form, but omits CVSS, CWE, exploit maturity, privilege details, and remediation. Avoid assuming affected versions beyond 'through 9.1' or claiming active exploitation without additional sourcing.
Mitigation direction
- Check Blackboard vendor guidance for fixed versions or supported mitigations.
- Inventory Blackboard Learn instances and confirm whether version 9.1 or earlier is present.
- Limit Feedback to Learner access to trusted roles until remediation is confirmed.
- Monitor for suspicious feedback submissions or unexpected script-like content.
- Prioritize upgrade planning if the deployment is unsupported or no fix is available.
Validation and detection
- Confirm deployed Blackboard Learn version and patch level.
- Verify whether the Feedback to Learner form is enabled and who can use it.
- Review role permissions for students, instructors, graders, and administrators.
- Check logs or records for unusual feedback content submitted by authenticated users.
- Track vendor or institutional security advisories for definitive remediation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-36747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/cseasholtz/CVE-2021-36747CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.