Read the docs
TI-2024-29377 Aliases CVE-2024-43782

openedx-translations's Atlas translations for Open edX missing validation

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00542 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxopenedx-translations< b2444340e8702c7955310331c1db5fd85b25b92b—No fix listedCNA
  • openedx-translations Vendoropenedx Affected < b2444340e8702c7955310331c1db5fd85b25b92b Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openedx:openedx:redwood1:*:*:*:*:*:*:*redwood1Vulnerableopenedx
cpe:2.3:a:openedx:openedx:redwood2:*:*:*:*:*:*:*redwood2Vulnerableopenedx
  • cpe:2.3:a:openedx:openedx:redwood1:*:*:*:*:*:*:* Versions redwood1 Vulnerable ·openedx
  • cpe:2.3:a:openedx:openedx:redwood2:*:*:*:*:*:*:* Versions redwood2 Vulnerable ·openedx

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-43782

References

Patch 3

  • TI-2026-31065 Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint CVSS 3.1CRITICAL 9.9
  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
  • TI-2026-31064 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences