medium5.4
CVE-2020-13145
Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen.
Impact
Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can contain JavaScript code and thus lead to Stored XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Edx | Open Edx Platform | Version 2.5 |