CVE-2020-13146: High severity open edx vulnerability

Published May 18, 2020

Updated

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.

Affected Software

1 affected component

edx Open Edx Platform=2.5

Event History

May 18, 2020

CVE Published

via MITRE·06:24 PM

Data Sourced

via MITRE·06:24 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-13146?

CVE-2020-13146 is considered a medium severity vulnerability due to potential data manipulation risks.

How do I fix CVE-2020-13146?

To fix CVE-2020-13146, ensure that any input for cohorts does not contain executable formulas or sanitize the CSV exports.

Who is affected by CVE-2020-13146?

Users of the Open edX platform version 2.5 are specifically affected by CVE-2020-13146.

What kind of attack can be executed through CVE-2020-13146?

CVE-2020-13146 can be exploited through malicious CSV files that contain formulas, leading to CSV injection attacks.

Where can I find more information about CVE-2020-13146?

Details about CVE-2020-13146 can typically be found in security advisories or documentation related to Open edX.