fkie_cve-2025-47942
Vulnerability from fkie_nvd
Published
2025-05-21 22:15
Modified
2025-05-23 15:55
Severity ?
Summary
The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Open edX Platform is a learning management platform. Prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp has no built-in protection against downloading the python_lib.zip asset from courses, which is a concern since it often contains custom grading code or answers to course problems. This potentially affects any course using custom Python-graded problem blocks. The openedx/configuration repo has had a patch since 2016 in the form of an nginx rule, but this was only intended as a temporary mitigation. As the configuration repo has been deprecated and we have not been able to locate any similar protection in Tutor, it is likely that most deployments have no protection against python_lib.zip being downloaded. The recommended mitigation, implemented in commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restricts python_lib.zip downloads to just the course team and site staff/superusers."
},
{
"lang": "es",
"value": "La plataforma Open edX es una plataforma de gesti\u00f3n del aprendizaje. Antes de el commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, edxapp no contaba con protecci\u00f3n integrada contra la descarga del archivo python_lib.zip de los cursos, lo cual es preocupante, ya que suele contener c\u00f3digo de calificaci\u00f3n personalizado o respuestas a problemas del curso. Esto podr\u00eda afectar a cualquier curso que utilice bloques de problemas personalizados con calificaci\u00f3n de Python. El repositorio de configuraci\u00f3n de OpenX cuenta con un parche desde 2016, una regla de Nginx, pero su prop\u00f3sito era solo una mitigaci\u00f3n temporal. Dado que el repositorio de configuraci\u00f3n ha quedado obsoleto y no hemos podido encontrar una protecci\u00f3n similar en Tutor, es probable que la mayor\u00eda de las implementaciones no cuenten con protecci\u00f3n contra la descarga de python_lib.zip. La mitigaci\u00f3n recomendada, implementada en el commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, restringe las descargas de python_lib.zip \u00fanicamente al equipo del curso y al personal/superusuarios del sitio."
}
],
"id": "CVE-2025-47942",
"lastModified": "2025-05-23T15:55:02.040",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2025-05-21T22:15:50.817",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/edx/configuration/blob/3471fc036a6664cedd3e2d78403dca73bc1cda51/playbooks/roles/nginx/templates/edx/app/nginx/sites-available/python_lib.zip.j2"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/openedx/edx-platform/commit/6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/openedx/edx-platform/security/advisories/GHSA-x5cm-2hpq-pw57"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…