CVE-2024-26140
com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser
- State
- Published
- Severity
- 4.6 Medium
- Published
- Feb 20, 2024
- Updated
- Aug 1, 2024
- Reserved
- Feb 14, 2024
Description
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L | GitHub_M |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
lrsyetanalytics |
|
References
- https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46
- https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621
- https://clojars.org/com.yetanalytics/lrs/versions/1.2.17
- https://github.com/yetanalytics/lrs/releases/tag/v1.2.17
- https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.