Openedx Platform
Monthly
Missing authorization on the `set_course_mode_price()` instructor endpoint in Open edX Platform allows any authenticated user - including learner accounts with zero course roles - to overwrite the honor-mode price and currency for any course on the platform. The view at `lms/djangoapps/instructor/views/instructor_dashboard.py:430` enforces only `@login_required` with no course-level role check, and became an orphaned API route after its companion frontend modal was removed. No public exploit code has been identified at time of analysis, but the low barrier (any valid session) makes automated mass-price manipulation trivially scripted against internet-facing LMS instances.
Server-side request forgery (SSRF) in Open edX Platform allows authenticated Enterprise Admin users to force the application server to make HTTP requests to arbitrary internal network resources, cloud metadata endpoints (AWS 169.254.169.254), or external attacker-controlled hosts via the sync_provider_data SAML configuration endpoint. The unvalidated metadata_url parameter is passed directly to requests.get() without IP filtering or URL scheme enforcement, enabling internal network reconnaissance, credential theft from cloud metadata services, and potential lateral movement. Fixed in commits 6fda1f120ff and 70a56246dd9. EPSS data not available; no confirmed active exploitation at time of analysis.
Server-Side Request Forgery with full response exfiltration in Open edX Platform's Studio CMS video download endpoint allows authenticated course staff to pivot from the application server into internal networks. A course staff user submits an attacker-controlled URL in the `files[].url` parameter; the CMS backend unconditionally fetches the target via `requests.get(url, allow_redirects=True)` and packages the raw response bytes into a ZIP returned to the caller. Redirect chaining is enabled and no timeout is enforced on the fetch path, enabling blind SSRF amplification and potential cloud-metadata credential theft. No public exploit or active exploitation has been identified at time of analysis. The fix, committed at 00b7c3c, restricts fetches to URL allowlisted from the course's own VAL-registered video encodings.
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI launch request to resubmit it an unlimited number of times, gaining unauthorized access to course content or LTI tool sessions as the original user. Prior to commit 3a5ac85, the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py returned True unconditionally, performing neither timestamp window checks nor nonce deduplication, rendering the entire OAuth 1.0a replay-protection layer inert. The issue has been patched via three commits introducing atomic nonce storage through Django's shared cache backend, with no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CSS into discussion notification emails sent to other users by bypassing insufficient HTML sanitization in the clean_thread_html_body() function. The vulnerability affects all versions prior to the fix commit and enables email tracking through malicious stylesheets, content spoofing, and phishing attacks against recipients who view notification emails.
Open edX Platform versions prior to commit 76462f1e5fa9b37d2621ad7ad19514b403908970 suffer from an open redirect vulnerability in the view_survey endpoint that accepts unvalidated redirect_url parameters, enabling attackers to redirect authenticated users to arbitrary attacker-controlled URLs for phishing and credential theft. The vulnerability requires user interaction (clicking a malicious link) to trigger the redirect but affects all versions of the platform until the specific commit is applied; no public exploit code has been identified at the time of analysis.
Open edX Platform from maple release through ulmo allows unauthenticated attackers to bypass email verification by exploiting an OAuth2 password grant that issues tokens to inactive users combined with exposure of activation keys in the REST API response at /api/user/v1/accounts/. This authentication bypass enables account takeover and unauthorized access to learning platforms. The vulnerability affects all deployments from maple to before ulmo release and has been patched in the ulmo release.
Missing authorization on the `set_course_mode_price()` instructor endpoint in Open edX Platform allows any authenticated user - including learner accounts with zero course roles - to overwrite the honor-mode price and currency for any course on the platform. The view at `lms/djangoapps/instructor/views/instructor_dashboard.py:430` enforces only `@login_required` with no course-level role check, and became an orphaned API route after its companion frontend modal was removed. No public exploit code has been identified at time of analysis, but the low barrier (any valid session) makes automated mass-price manipulation trivially scripted against internet-facing LMS instances.
Server-side request forgery (SSRF) in Open edX Platform allows authenticated Enterprise Admin users to force the application server to make HTTP requests to arbitrary internal network resources, cloud metadata endpoints (AWS 169.254.169.254), or external attacker-controlled hosts via the sync_provider_data SAML configuration endpoint. The unvalidated metadata_url parameter is passed directly to requests.get() without IP filtering or URL scheme enforcement, enabling internal network reconnaissance, credential theft from cloud metadata services, and potential lateral movement. Fixed in commits 6fda1f120ff and 70a56246dd9. EPSS data not available; no confirmed active exploitation at time of analysis.
Server-Side Request Forgery with full response exfiltration in Open edX Platform's Studio CMS video download endpoint allows authenticated course staff to pivot from the application server into internal networks. A course staff user submits an attacker-controlled URL in the `files[].url` parameter; the CMS backend unconditionally fetches the target via `requests.get(url, allow_redirects=True)` and packages the raw response bytes into a ZIP returned to the caller. Redirect chaining is enabled and no timeout is enforced on the fetch path, enabling blind SSRF amplification and potential cloud-metadata credential theft. No public exploit or active exploitation has been identified at time of analysis. The fix, committed at 00b7c3c, restricts fetches to URL allowlisted from the course's own VAL-registered video encodings.
OAuth nonce replay attacks against Open edX LMS's LTI 1.1 Provider endpoint allow an attacker who intercepts a valid LTI launch request to resubmit it an unlimited number of times, gaining unauthorized access to course content or LTI tool sessions as the original user. Prior to commit 3a5ac85, the validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py returned True unconditionally, performing neither timestamp window checks nor nonce deduplication, rendering the entire OAuth 1.0a replay-protection layer inert. The issue has been patched via three commits introducing atomic nonce storage through Django's shared cache backend, with no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CSS into discussion notification emails sent to other users by bypassing insufficient HTML sanitization in the clean_thread_html_body() function. The vulnerability affects all versions prior to the fix commit and enables email tracking through malicious stylesheets, content spoofing, and phishing attacks against recipients who view notification emails.
Open edX Platform versions prior to commit 76462f1e5fa9b37d2621ad7ad19514b403908970 suffer from an open redirect vulnerability in the view_survey endpoint that accepts unvalidated redirect_url parameters, enabling attackers to redirect authenticated users to arbitrary attacker-controlled URLs for phishing and credential theft. The vulnerability requires user interaction (clicking a malicious link) to trigger the redirect but affects all versions of the platform until the specific commit is applied; no public exploit code has been identified at the time of analysis.
Open edX Platform from maple release through ulmo allows unauthenticated attackers to bypass email verification by exploiting an OAuth2 password grant that issues tokens to inactive users combined with exposure of activation keys in the REST API response at /api/user/v1/accounts/. This authentication bypass enables account takeover and unauthorized access to learning platforms. The vulnerability affects all deployments from maple to before ulmo release and has been patched in the ulmo release.