Description
Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.
Exploits (1)
exploitdb
WORKING POC
by Daniel Monzón · textwebappsmultiple
https://www.exploit-db.com/exploits/48500
References (3)
Scores
CVSS v3
8.8
EPSS
0.0393
EPSS Percentile
88.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-862
CWE-94
Status
published
Products (1)
edx/open_edx_platform
2.5
Published
May 18, 2020
Tracked Since
Feb 18, 2026