PT-2020-13353

CVE-2020-13146

·

Published

2020-05-18

·

Updated

2021-07-21

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Open edX Studio version 2.5
Description The issue allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.
Recommendations For Open edX Studio version 2.5, consider restricting access to the "Course>Data Downloads>Reports>Download profile info" feature until a patch is available to prevent potential CSV injection attacks. Additionally, avoid adding cohorts with formulas in the Course>Instructor>Cohorts section to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Related identifiers
CVE-2020-13146
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com