Search criteria
8 vulnerabilities found for edx-platform by openedx
CVE-2025-68270 (GCVE-0-2025-68270)
Vulnerability from cvelistv5 – Published: 2025-12-16 18:26 – Updated: 2025-12-16 19:55
VLAI?
Title
CourseLimitedStaff Role Allows Studio Access
Summary
The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.
Severity ?
9.9 (Critical)
CWE
- CWE-862 - Missing Authorization
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< 05d0d0936daf82c476617257aa6c35f0cd4ca060
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-16T19:55:14.919725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T19:55:40.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 05d0d0936daf82c476617257aa6c35f0cd4ca060"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:26:31.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj"
},
{
"name": "https://github.com/openedx/edx-platform/pull/37772",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/pull/37772"
},
{
"name": "https://github.com/openedx/edx-platform/pull/37773",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/pull/37773"
},
{
"name": "https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060"
}
],
"source": {
"advisory": "GHSA-rh64-vc2h-7wfj",
"discovery": "UNKNOWN"
},
"title": "CourseLimitedStaff Role Allows Studio Access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68270",
"datePublished": "2025-12-16T18:26:31.224Z",
"dateReserved": "2025-12-16T14:05:31.363Z",
"dateUpdated": "2025-12-16T19:55:40.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-47942 (GCVE-0-2025-47942)
Vulnerability from cvelistv5 – Published: 2025-05-21 21:15 – Updated: 2025-05-22 15:04
VLAI?
Title
Learners on edX Platform can download python_lib.zip
Summary
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers.
Severity ?
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-47942",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T15:04:17.683575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T15:04:42.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-21T21:15:06.165Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57"
},
{
"name": "https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba"
},
{
"name": "https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2"
}
],
"source": {
"advisory": "GHSA-x5cm-2hpq-pw57",
"discovery": "UNKNOWN"
},
"title": "Learners on edX Platform can download python_lib.zip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-47942",
"datePublished": "2025-05-21T21:15:06.165Z",
"dateReserved": "2025-05-14T10:32:43.530Z",
"dateUpdated": "2025-05-22T15:04:42.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41806 (GCVE-0-2024-41806)
Vulnerability from cvelistv5 – Published: 2024-07-25 14:34 – Updated: 2024-08-02 04:46
VLAI?
Title
Open edX Platform's instructor upload CSV for cohort creation not Private by Default
Summary
The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.
Severity ?
5.3 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< cb729a3ced0404736dfa0ae768526c82b608657b
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"lessThan": "cb729a3ced0404736dfa0ae768526c82b608657b",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-26T14:01:38.878588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T14:03:58.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c"
},
{
"name": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c cb729a3ced0404736dfa0ae768526c82b608657b"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:34:12.579Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c"
},
{
"name": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b"
}
],
"source": {
"advisory": "GHSA-4528-7fh6-x75c",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform\u0027s instructor upload CSV for cohort creation not Private by Default"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41806",
"datePublished": "2024-07-25T14:34:12.579Z",
"dateReserved": "2024-07-22T13:57:37.135Z",
"dateUpdated": "2024-08-02T04:46:52.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22209 (GCVE-0-2024-22209)
Vulnerability from cvelistv5 – Published: 2024-01-13 07:40 – Updated: 2024-10-24 15:08
VLAI?
Title
XBlock custom auth does not respect JWT Scopes
Summary
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
Severity ?
6.4 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< commit 019888f
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:34.932Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm"
},
{
"name": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e"
},
{
"name": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"lessThan": "commit_019888f",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T15:05:57.370655Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T15:08:35.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c commit 019888f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-13T07:40:44.052Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm"
},
{
"name": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e"
},
{
"name": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775"
}
],
"source": {
"advisory": "GHSA-qx8m-mqx3-j9fm",
"discovery": "UNKNOWN"
},
"title": "XBlock custom auth does not respect JWT Scopes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-22209",
"datePublished": "2024-01-13T07:40:44.052Z",
"dateReserved": "2024-01-08T04:59:27.374Z",
"dateUpdated": "2024-10-24T15:08:35.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-68270 (GCVE-0-2025-68270)
Vulnerability from nvd – Published: 2025-12-16 18:26 – Updated: 2025-12-16 19:55
VLAI?
Title
CourseLimitedStaff Role Allows Studio Access
Summary
The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue.
Severity ?
9.9 (Critical)
CWE
- CWE-862 - Missing Authorization
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< 05d0d0936daf82c476617257aa6c35f0cd4ca060
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-16T19:55:14.919725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T19:55:40.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 05d0d0936daf82c476617257aa6c35f0cd4ca060"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to access and edit courses in studio if they are granted the role on an org rather than on a course, and CourseLimitedStaffRole users are able to list courses they have the role on in studio even though they are not meant to have any access on the studio side for the course. Commit 05d0d0936daf82c476617257aa6c35f0cd4ca060 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-16T18:26:31.224Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-rh64-vc2h-7wfj"
},
{
"name": "https://github.com/openedx/edx-platform/pull/37772",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/pull/37772"
},
{
"name": "https://github.com/openedx/edx-platform/pull/37773",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/pull/37773"
},
{
"name": "https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/05d0d0936daf82c476617257aa6c35f0cd4ca060"
}
],
"source": {
"advisory": "GHSA-rh64-vc2h-7wfj",
"discovery": "UNKNOWN"
},
"title": "CourseLimitedStaff Role Allows Studio Access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68270",
"datePublished": "2025-12-16T18:26:31.224Z",
"dateReserved": "2025-12-16T14:05:31.363Z",
"dateUpdated": "2025-12-16T19:55:40.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-47942 (GCVE-0-2025-47942)
Vulnerability from nvd – Published: 2025-05-21 21:15 – Updated: 2025-05-22 15:04
VLAI?
Title
Learners on edX Platform can download python_lib.zip
Summary
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers.
Severity ?
5.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-47942",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T15:04:17.683575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T15:04:42.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-21T21:15:06.165Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57"
},
{
"name": "https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba"
},
{
"name": "https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2"
}
],
"source": {
"advisory": "GHSA-x5cm-2hpq-pw57",
"discovery": "UNKNOWN"
},
"title": "Learners on edX Platform can download python_lib.zip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-47942",
"datePublished": "2025-05-21T21:15:06.165Z",
"dateReserved": "2025-05-14T10:32:43.530Z",
"dateUpdated": "2025-05-22T15:04:42.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41806 (GCVE-0-2024-41806)
Vulnerability from nvd – Published: 2024-07-25 14:34 – Updated: 2024-08-02 04:46
VLAI?
Title
Open edX Platform's instructor upload CSV for cohort creation not Private by Default
Summary
The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.
Severity ?
5.3 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< cb729a3ced0404736dfa0ae768526c82b608657b
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"lessThan": "cb729a3ced0404736dfa0ae768526c82b608657b",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-26T14:01:38.878588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T14:03:58.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c"
},
{
"name": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c cb729a3ced0404736dfa0ae768526c82b608657b"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:34:12.579Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c"
},
{
"name": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b"
}
],
"source": {
"advisory": "GHSA-4528-7fh6-x75c",
"discovery": "UNKNOWN"
},
"title": "Open edX Platform\u0027s instructor upload CSV for cohort creation not Private by Default"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-41806",
"datePublished": "2024-07-25T14:34:12.579Z",
"dateReserved": "2024-07-22T13:57:37.135Z",
"dateUpdated": "2024-08-02T04:46:52.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22209 (GCVE-0-2024-22209)
Vulnerability from nvd – Published: 2024-01-13 07:40 – Updated: 2024-10-24 15:08
VLAI?
Title
XBlock custom auth does not respect JWT Scopes
Summary
Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f.
Severity ?
6.4 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| openedx | edx-platform |
Affected:
< commit 019888f
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:34.932Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm"
},
{
"name": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e"
},
{
"name": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"lessThan": "commit_019888f",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-22209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T15:05:57.370655Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T15:08:35.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "edx-platform",
"vendor": "openedx",
"versions": [
{
"status": "affected",
"version": "\u003c commit 019888f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access. This vulnerability has been patched in commit 019888f."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-13T07:40:44.052Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-qx8m-mqx3-j9fm"
},
{
"name": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/commit/019888f3d15beaebcb7782934f6c43b0c2b3735e"
},
{
"name": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openedx/edx-platform/blob/0b3e4d73b6fb6f41ae87cf2b77bca12052ee1ac8/lms/djangoapps/courseware/block_render.py#L752-L775"
}
],
"source": {
"advisory": "GHSA-qx8m-mqx3-j9fm",
"discovery": "UNKNOWN"
},
"title": "XBlock custom auth does not respect JWT Scopes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-22209",
"datePublished": "2024-01-13T07:40:44.052Z",
"dateReserved": "2024-01-08T04:59:27.374Z",
"dateUpdated": "2024-10-24T15:08:35.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}