CVE-2020-13146

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...

CVE-2020-13146

Open edX Ironwood 2.5 Studio is affected by a CSV injection vulnerability. The issue arises when an added cohort in Course > Instructor > Cohorts may contain a formula that is exported through Course > Data Downloads > Reports > Download profile info, allowing injection in exported...