The vulnerability in the Open edX Platform Studio's video download endpoint allows a server‑side request forgery (SSRF) whereby an attacker can supply arbitrary URLs for the platform to fetch and subsequently expose the fetched data via a ZIP response. The weakness stems from unvalidated, unauthenticated input of file URLs and a server‑side HTTP GET with redirection and no timeout, providing a conduit for arbitrary internal or external resource disclosure and potential data exfiltration. This flaw may allow attackers to reach internal services, harvest sensitive data, or send requests to arbitrary endpoints on behalf of the platform, thereby compromising confidentiality, integrity, and availability.

Open edX Platform (product: Open edX Platform, vendor: OpenedX) is affected. Prior to the commit dated 00b7c3c, the platform allowed this SSRF in the Studio video download endpoint. The risk applies to any deployment of the platform using versions that lack this patch; the fix is included in the commit and subsequent releases.

The CVSS score of 6.8 classifies this as a moderate severity flaw, and the EPSS score is not available, indicating that the exploit likelihood is currently unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers can exploit the flaw by sending a crafted request to the vulnerable endpoint, possibly as an authenticated content author or instructor. The ability to follow redirects and the absence of a timeout provide an attacker with the potential to reach internal network services or exfiltrate data. While the precise exploitation path is not detailed, the infrastructure needed for SSRF (server network access) is generally available in most Open edX deployments, making this a credible threat that warrants rapid remediation.