The vulnerability exists in the sync_provider_data endpoint of Open edx Enterprise Service versions 7.0.2 through 7.0.4. An authenticated user with Enterprise Admin privileges can modify the metadata_source URL, then invoke sync_provider_data to make an unfiltered server‑side HTTP request to that URL. Because the request is performed with requests.get() without scheme validation, IP filtering, or a timeout, the application is susceptible to server‑side request forgery that can expose internal resources, access privileged data, or facilitate further attacks. The weakness is CWE‑918.

The affected product is Open edx Enterprise (edx-enterprise) version 7.0.2, 7.0.3, and 7.0.4. The issue is resolved in 7.0.5 and later releases. Users running any of the vulnerable versions should consider their deployment of the sync_provider_data endpoint reachable from the Enterprise Admin role.

The CVSS vector indicates a base score of 8.5, classifying the flaw as high severity. While no EPSS score is available, the lack of mitigation such as timeout or whitelist expands the potential exploitation surface. The issue is not listed in CISA KEV, suggesting no publicly known exploits at the time of this analysis. The likely attack path requires administrative access to the Enterprise Admin role and the ability to trigger the sync_provider_data operation, indicating that privilege escalation within the internal role set is the main prerequisite.