CVE-2026-42860
CVE-2026-42860 · Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
CVSS 8.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
edx-enterprise
- Versiones
- >= 7.0.2, < 7.0.5: Afectada
Sin corrección publicada
edx-enterprise PyPI
- Versiones
- 7.0.2
- 7.0.3
- 7.0.4
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 7.0.2, < 7.0.5
Actualiza a 7.0.5