edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
{ "versions": [ { "introduced": "0" }, { "fixed": "2017-08-03" } ] }
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18380.json"