Read the docs
TI-2024-27851 Aliases CVE-2024-41806

Open edX Platform's instructor upload CSV for cohort creation not Private by Default

Priority LOW 30CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxedx-platform< cb729a3—No fix listedCNA
  • edx-platform Vendoropenedx Affected < cb729a3 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:*——openedx
  • cpe:2.3:a:openedx:edx-platform:*:*:*:*:*:*:*:* Versions — — ·openedx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41806

References

Other 2

  • TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
  • TI-2022-22791 Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fields CVSS 3.1HIGH 8.4
  • TI-2026-31067 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint CVSS 3.1HIGH 8.5
  • TI-2026-38679 Open edX Platform: Insufficient Permission on set_course_mode_price() CVSS 3.1HIGH 7.6
  • TI-2026-26980 Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API CVSS 3.1MEDIUM 5.3
  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences