Input validation

2020-05-1819:15:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

65.1%

JSON

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the “Course>Data Downloads>Reports>Download profile info” feature.

CPENameOperatorVersion
open_edx_platformeq2.5

CPE	Name	Operator	Version
	open_edx_platform	eq	2.5

References

stark0de.com/2020/05/17/openedx-vulnerabilities.html