CVE-2024-41806

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available when the uploader uses versions master, palm, olive, nutmeg, maple, lilac, koa, or juniper. The patch in commit cb729a3ced0404736dfa0ae768526c82b608657b ensures that cohorts data uploaded to AWS S3 buckets is written with a private ACL. Beyond patching, deployers should also ensure that existing cohorts uploads have a private ACL, or that other precautions are taken to avoid public access.

• CWE-284

• https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b
• https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c
• https://github.com/openedx/edx-platform/commit/cb729a3ced0404736dfa0ae768526c82b608657b
• https://github.com/openedx/edx-platform/security/advisories/GHSA-4528-7fh6-x75c

Published

Jul 25, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41800Craft is a content management system (CMS). Craft CMS 5 allo…7.5
• CVE-2024-41801OpenProject is open source project management software. Prio…6.1
• CVE-2024-41802Xibo is a content management system (CMS). An SQL injection …8.1
• CVE-2024-41803Xibo is a content management system (CMS). An SQL injection …4.9
• CVE-2024-41804Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41805Tracks, a Getting Things Done (GTD) web application, is vuln…6.1
• CVE-2024-41807Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Co…
• CVE-2024-41808The OpenObserve open-source observability platform provides …5.4
• CVE-2024-41809OpenObserve is an open-source observability platform. Starti…6.1
• CVE-2024-4181A command injection vulnerability exists in the RunGptLLM cl…8.8
• CVE-2024-41810Twisted is an event-based framework for internet application…6.1
• CVE-2024-41811ipl/web is a set of common web components for php projects. …3.9