{"id":"CVE-2020-13144","aliases":["EUVD-2020-5420","GHSA-hc63-fv38-p9mv"],"status":"published","title":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create...","description":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create New course\u003eNew section\u003eNew subsection\u003eNew unit\u003eAdd new component\u003eProblem button\u003eAdvanced tab\u003eCustom Python evaluated code\" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.10963,"percentile":0.95946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-862","CWE-94"],"published":"2020-05-18T18:23:55Z","modified":"2026-06-17T02:52:41Z","exploits":[{"source":"exploitdb","id":"EDB-48500","title":"OpenEDX platform Ironwood 2.5 - Remote Code Execution","type":"webapps","platform":"multiple","date":"2020-05-21","url":"https://www.exploit-db.com/exploits/48500"}],"products":[{"vendor":"edx","product":"open_edx_platform"}],"references":[{"url":"https://stark0de.com/2020/05/17/openedx-vulnerabilities.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://edx.readthedocs.io/projects/edx-developer-guide/en/latest/architecture.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/157785/OpenEDX-Ironwood-2.5-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13144"},{"url":"https://github.com/advisories/GHSA-hc63-fv38-p9mv"}],"sources":{"cve":[{"id":"CVE-2020-13144","description":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create New course\u003eNew section\u003eNew subsection\u003eNew unit\u003eAdd new component\u003eProblem button\u003eAdvanced tab\u003eCustom Python evaluated code\" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.","status":"published","published":"2020-05-18T18:23:55Z","modified":"2024-08-04T12:11:19.222Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-5420","description":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create New course\u003eNew section\u003eNew subsection\u003eNew unit\u003eAdd new component\u003eProblem button\u003eAdvanced tab\u003eCustom Python evaluated code\" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.","status":"published","published":"2020-05-18T18:23:55Z","modified":"2024-08-04T12:11:19Z","updated_at":"2026-11-03T03:07:38.81332Z"}],"ghsa":[{"id":"GHSA-hc63-fv38-p9mv","title":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create...","description":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create New course\u003eNew section\u003eNew subsection\u003eNew unit\u003eAdd new component\u003eProblem button\u003eAdvanced tab\u003eCustom Python evaluated code\" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.","status":"published","published":"2022-05-24T17:18:05Z","modified":"2023-01-29T05:02:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-94"],"updated_at":"2026-11-02T14:45:09.006349Z"}],"nvd":[{"id":"CVE-2020-13144","description":"Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the \"Create New course\u003eNew section\u003eNew subsection\u003eNew unit\u003eAdd new component\u003eProblem button\u003eAdvanced tab\u003eCustom Python evaluated code\" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.","status":"published","published":"2020-05-18T19:15:11.48Z","modified":"2026-06-17T02:52:41.183Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-862"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}