The Open edX Platform includes a sync_provider_data endpoint that permits Enterprise Admin users to submit an arbitrary metadata URL. The server forwards this URL to requests.get() without validating the scheme, enforcing IP filtering, or applying a whitelist. This lack of validation allows the request to be directed to any host reachable from the server, effectively giving the attacker a server‑side request forgery capability. An attacker who can achieve Enterprise Admin privileges can cause the platform to contact internal services, cloud metadata endpoints such as AWS’s 169.254.169.254, or any external hosts, potentially exposing sensitive data or facilitating further compromise.

Any deployment of the Open edX Platform that includes the sync_provider_data endpoint exposed prior to the security fix. The affected product is Open edX Platform (openedx:openedx-platform). No specific version range is listed, so all versions before the patches identified in the advisory are considered vulnerable.

The severity of the flaw is reflected by a CVSS score of 8.5, classifying it as high impact once the attacker gains the necessary authentication level. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation to date. The attack vector requires an authenticated Enterprise Admin, but once such access is attained the server can contact arbitrary internal resources, presenting a clear path for internal reconnaissance or data exfiltration. Because the flaw is an SSRF, attackers can also attempt to reach privileged cloud service endpoints, enabling further privilege escalation.