edx-enterprise
Your project description goes here
View on Github
Activity
- Latest release
- 3d ago
- Total releases
- 1470
- Cadence
- ~daily
- Last 12 months
- 69
Reach
- Stars
- 50
Details
- License
- unknown
- First release
- Oct 24, 2016
| Version | Released | |
|---|---|---|
8.12.0
minor
| ||
8.11.0
minor
| ||
8.10.0
minor
| ||
8.9.4
patch
| ||
8.9.3
patch
| ||
8.9.2
patch
| ||
8.9.0
minor
| ||
8.8.0
minor
| ||
8.7.2
patch
| ||
8.7.1
patch
| ||
8.7.0
minor
| ||
8.6.0
minor
| ||
8.5.0
minor
| ||
8.4.0
minor
| ||
8.3.0
minor
| ||
8.2.0
minor
| ||
8.1.2
patch
| ||
8.1.1
patch
| ||
8.1.0
minor
| ||
8.0.19
patch
| ||
8.0.18
patch
| ||
8.0.17
patch
| ||
8.0.16
patch
| ||
8.0.15
patch
| ||
8.0.14
patch
| ||
8.0.13
patch
| ||
8.0.12
patch
| ||
8.0.10
patch
| ||
8.0.9
patch
| ||
8.0.8
patch
| ||
8.0.6
patch
| ||
8.0.5
patch
| ||
8.0.4
patch
| ||
8.0.3
patch
| ||
8.0.2
patch
| ||
8.0.1
patch
| ||
8.0.0
major
| ||
7.0.7
patch
| ||
7.0.6
patch
| ||
7.0.5
patch
| ||
7.0.4
patch
1 CVE
CVE-2026-42860
PYSEC-2026-58
GHSA-64cv-vxpr-j6vc
May 11, 2026
8.5
/ 10
High
Network
Low
Low
None
Changed
High
Low
None
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5. Affected versions
7.0.2
7.0.3
7.0.4
Fixed in
7.0.5
Updated May 20, 2026 · Source: OSV.dev | ||
7.0.3
patch
1 CVE
CVE-2026-42860
PYSEC-2026-58
GHSA-64cv-vxpr-j6vc
May 11, 2026
8.5
/ 10
High
Network
Low
Low
None
Changed
High
Low
None
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5. Affected versions
7.0.2
7.0.3
7.0.4
Fixed in
7.0.5
Updated May 20, 2026 · Source: OSV.dev | ||
7.0.2
patch
1 CVE
CVE-2026-42860
PYSEC-2026-58
GHSA-64cv-vxpr-j6vc
May 11, 2026
8.5
/ 10
High
Network
Low
Low
None
Changed
High
Low
None
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5. Affected versions
7.0.2
7.0.3
7.0.4
Fixed in
7.0.5
Updated May 20, 2026 · Source: OSV.dev | ||
7.0.1
patch
| ||
7.0.0
major
| ||
6.8.6
patch
| ||
6.8.5
patch
| ||
6.8.4
patch
| ||
6.8.3
patch
| ||
6.8.2
patch
|