Edx develops the Open edX platform, a widely adopted open-source learning management system deployed across educational institutions and corporate training environments, creating a web-facing attack surface spanning authentication, content delivery, and user-data handling. The vendor's vulnerability disclosures cluster around web-application input-handling and access-control issues, including cross-site scripting, cross-site request forgery, improper input validation, and unauthorized information exposure—weakness classes characteristic of large, user-interactive platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Edx over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-13144HIGH Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advan | May 18, 2020 | 8.8 | 36 | NO | YES |
CVE-2022-32195MEDIUM Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. | Jun 9, 2022 | 6.1 | 32 | NO | YES |
CVE-2020-13146HIGH Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is exported via the "Course>Data Downloads>Repo | May 18, 2020 | 8.8 | 29 | NO | NO |
CVE-2016-10766HIGH edx-platform before 2016-06-06 allows CSRF. | Jul 29, 2019 | 8.8 | 28 | NO | NO |
CVE-2015-5601HIGH edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files. | Jul 29, 2019 | 8.8 | 28 | NO | NO |
CVE-2017-18380HIGH edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name. | Jul 30, 2019 | 7.5 | 25 | NO | NO |
CVE-2024-22209HIGH Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes could call endpoints exceeding their access | Jan 13, 2024 | 8.8 | 24 | NO | NO |
CVE-2017-18381HIGH The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials. | Jul 30, 2019 | 7.2 | 24 | NO | NO |
CVE-2021-39248MEDIUM Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion. | Aug 17, 2021 | 6.1 | 21 | NO | NO |
CVE-2018-20858MEDIUM Recommender before 2018-07-18 allows XSS. | Aug 9, 2019 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Edx.
Media articles that mention a CVE ID that affects a product developed by Edx — matched by CVE ID, not by vendor name.