CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

PT-2020-13352

Name of the Vulnerable Software and Affected Versions Open edX Ironwood version 2.5 Description The issue allows users to upload SVG files via the "ContentFile Uploads" screen, which can contain JavaScript code, leading to Stored XSS. Recommendations For Open edX Ironwood version 2.5, consider...