High severity8.8NVD Advisory· Published May 18, 2020· Updated Jun 17, 2026

CVE-2020-13146

Description

Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Reports>Download profile info" feature.

Affected products

Open edX/Studiodescription
Openedx/Studiollm-create
Range: <=2.5
Openedx/Openedxllm-create
Range: <=2.5

Patches

Vulnerability mechanics

References

stark0de.com/2020/05/17/openedx-vulnerabilities.htmlnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000