Input validation

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

Cross site scripting

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2020-13145

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2020-13145

CVE-2020-13145 affects Open edX Studio (Ironwood 2.5). The vulnerability arises from allowing SVG file uploads via the Content > File Uploads screen, where uploaded SVGs can contain JavaScript and trigger Stored XSS. Multiple connected sources corroborate the same description, noting lack of p...

CVE-2020-13146

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

CVE-2020-13146

Open edX Ironwood 2.5 Studio is affected by a CSV injection vulnerability. The issue arises when an added cohort in Course > Instructor > Cohorts may contain a formula that is exported through Course > Data Downloads > Reports > Download profile info, allowing injection in exported...

CVE-2020-13144

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...

CVE-2020-13144

CVE-2020-13144 affects Open edX Ironwood 2.5 Studio. When CodeJail is not enforced, an authenticated user can navigate to Create New course > New section > New subsection > New unit > Add new component > Problem > Advanced > Custom Python evaluated code, edit a problem and ex...

CVE-2020-13146: Improper Neutralization of Formula Elements in a CSV File

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

PT-2020-13352

Name of the Vulnerable Software and Affected Versions Open edX Ironwood version 2.5 Description The issue allows users to upload SVG files via the "ContentFile Uploads" screen, which can contain JavaScript code, leading to Stored XSS. Recommendations For Open edX Ironwood version 2.5, consider...

PT-2020-13351

Name of the Vulnerable Software and Affected Versions Open edX Ironwood version 2.5 Description The issue allows a user to execute arbitrary Python code when CodeJail is not used. This can be achieved by navigating to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem...

PT-2020-13353

Name of the Vulnerable Software and Affected Versions Open edX Studio version 2.5 Description The issue allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature. Recommendation...

CVE-2020-13145: Improper Neutralization of Input During Web Page Generation

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "ContentFile Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS...

CVE-2020-13144: Improper Control of Generation of Code

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New courseNew sectionNew subsectionNew unitAdd new componentProblem buttonAdvanced tabCustom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code...

CVE-2019-20513

Open edX Ironwood.1 allows support/certificates?user= reflected XSS...

CVE-2019-20513

Open edX Ironwood.1 allows support/certificates?user= reflected XSS...

Cross site scripting

Open edX Ironwood.1 allows support/certificates?user= reflected XSS...

CVE-2019-20513

Open edX Ironwood.1 allows support/certificates?user= reflected XSS...

CVE-2019-20513

Open edX Ironwood.1 is affected by a reflected XSS in the certificates flow, triggered by the parameter user in the URL (…?user=…). The issue arises from insufficient input validation in the web application, allowing an attacker-supplied payload to be reflected in the client context. Impact is sc...

PT-2020-10489

Name of the Vulnerable Software and Affected Versions Open edX Ironwood.1 Description The issue allows for reflected XSS, specifically through the support/certificates?user= endpoint. This can potentially lead to malicious script execution. Recommendations For Open edX Ironwood.1, as a temporary...