CVE-2020-13146

2020-05-1818:24:10

mitre

www.cve.org

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

65.1%

JSON

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the “Course>Data Downloads>Reports>Download profile info” feature.

References

stark0de.com/2020/05/17/openedx-vulnerabilities.html