The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2024-41806: The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-41806
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
CVE-2024-41806 affects the Open edX Platform. Instructors uploading CSV files with learner information to create cohorts in the instructor dashboard can have those files become publicly available on certain storage backends, when the uploader runs versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The flaw lies in how Django default storage handles these uploads.
Mitigation
The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures cohorts data uploaded to AWS S3 buckets is written with a private ACL. Deployers should also ensure existing cohorts uploads have a private ACL, or take other precautions to avoid public access.