CVE-2020-13144

Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.

• CWE-94
• CWE-862

• http://packetstormsecurity.com/files/157785/OpenEDX-Ironwood-2.5-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.htmlVendor Advisory
• https://stark0de.com/2020/05/17/openedx-vulnerabilities.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/157785/OpenEDX-Ironwood-2.5-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.htmlVendor Advisory
• https://stark0de.com/2020/05/17/openedx-vulnerabilities.htmlExploit, Third Party Advisory

Published

May 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13133Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vuln…6.1
• CVE-2020-13134Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vuln…4.8
• CVE-2020-13135D-Link DSP-W215 1.26b03 devices allow information disclosure…6.5
• CVE-2020-13136D-Link DSP-W215 1.26b03 devices send an obfuscated hash that…7.5
• CVE-2020-1314An elevation of privilege vulnerability exists in Windows Te…7.8
• CVE-2020-13143gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c i…6.5
• CVE-2020-13145Studio in Open edX Ironwood 2.5 allows users to upload SVG f…5.4
• CVE-2020-13146Studio in Open edX Ironwood 2.5 allows CSV injection because…8.8
• CVE-2020-13149Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" fo…7.8
• CVE-2020-1315An information disclosure vulnerability exists when Internet…5.3
• CVE-2020-13150D-link DSL-2750U ISL2750UEME3.V1E devices allow approximatel…7.8
• CVE-2020-13151Aerospike Community Edition 4.9.0.5 allows for unauthenticat…9.8