PT-2020-13352 · Edx · Open Edx

Published 2020-05-18 · Updated 2020-05-20 · CVE-2020-13145

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open edX Ironwood version 2.5

Description The issue allows users to upload SVG files via the "Content>File Uploads" screen, which can contain JavaScript code, leading to Stored XSS.

Recommendations For Open edX Ironwood version 2.5, consider disabling the file upload feature for SVG files until a patch is available to prevent Stored XSS attacks. Restrict access to the "Content>File Uploads" screen to minimize the risk of exploitation. Avoid using the file upload feature for SVG files in the affected version until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13145

Affected Products

Open Edx

References · 4

• 🔥 https://stark0de.com/2020/05/17/openedx-vulnerabilities.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-13145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13145 · Security Note
• https://t.me/cvenotify/3896 · Telegram Post