PT-2025-22436 · Unknown · Open Edx Platform

Published 2025-05-21 · Updated 2025-05-22 · CVE-2025-47942

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Open edX Platform versions prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba

Description The issue concerns the Open edX Platform, a learning management platform, where prior to a specific commit, there was no built-in protection against downloading the python lib.zip asset from courses. This asset often contains custom grading code or answers to course problems, posing a concern for courses using custom Python-graded problem blocks. A temporary mitigation was implemented in 2016 through an nginx rule in the openedx/configuration repo, but since this repository has been deprecated and no similar protection was found in Tutor, most deployments likely have no protection against python lib.zip being downloaded.

Recommendations For versions prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restrict python lib.zip downloads to just the course team and site staff/superusers, as implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-47942

GHSA-X5CM-2HPQ-PW57

Affected Products

Open Edx Platform

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47942.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-47942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47942 · Security Note
• https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba · Note
• https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57 · Note
• https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2 · Note
• https://twitter.com/CVEnew/status/1925303466962165992 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925396504375685404 · Twitter Post