Show filters
16 Total Results
Displaying 1-10 of 16
Sort by:
Attacker Value
Unknown
CVE-2024-41806
Disclosure Date: July 25, 2024 (last updated July 26, 2024)
The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.
0
Attacker Value
Unknown
CVE-2024-22209
Disclosure Date: January 13, 2024 (last updated January 23, 2024)
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
0
Attacker Value
Unknown
CVE-2021-39248
Disclosure Date: August 17, 2021 (last updated February 23, 2025)
Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
0
Attacker Value
Unknown
CVE-2020-13145
Disclosure Date: May 18, 2020 (last updated February 21, 2025)
Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS.
0
Attacker Value
Unknown
CVE-2020-13146
Disclosure Date: May 18, 2020 (last updated February 21, 2025)
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.
0
Attacker Value
Unknown
CVE-2020-13144
Disclosure Date: May 18, 2020 (last updated February 21, 2025)
Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.
0
Attacker Value
Unknown
CVE-2017-18381
Disclosure Date: July 30, 2019 (last updated November 08, 2023)
The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
0
Attacker Value
Unknown
CVE-2018-20859
Disclosure Date: July 30, 2019 (last updated November 08, 2023)
edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
0
Attacker Value
Unknown
CVE-2017-18380
Disclosure Date: July 30, 2019 (last updated November 08, 2023)
edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name.
0
Attacker Value
Unknown
CVE-2016-10765
Disclosure Date: July 29, 2019 (last updated November 27, 2024)
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
0
