The Open edX Platform's view_survey endpoint improperly handles the redirect_url GET parameter by passing it directly to HttpResponseRedirect() without validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the supplied URL, which can be attacker-controlled. Additionally, the unvalidated URL is included in a hidden form field and returned in a JSON response, where client-side JavaScript sets location.href to this URL. This open redirect vulnerability (CWE-601) enables phishing and credential theft attacks against authenticated users. The issue is fixed in commit 76462f1e5fa9b37d2621ad7ad19514b403908970.

An attacker can exploit this vulnerability to redirect users to malicious websites, potentially leading to phishing attacks and credential theft. The vulnerability does not directly impact confidentiality, integrity, or availability of the Open edX Platform itself but poses a risk to user security through social engineering. The CVSS score is 4.7 (medium severity), reflecting the network attack vector, low complexity, no privileges required, user interaction required, and limited confidentiality impact.

This vulnerability is fixed in commit 76462f1e5fa9b37d2621ad7ad19514b403908970. Users and administrators should update the Open edX Platform to this commit or a later version that includes the fix. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the presence of the fixing commit.