CVE-2024-26140

Katalog CVE

CVSS 6.1 · Medium EPSS 0,45%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada yetanalytics lrs, yetanalytics sql lrs. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.

Rincian

Terbit di NVD

20 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46 advisory vendor
• https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621 patch
• https://clojars.org/com.yetanalytics/lrs/versions/1.2.17 product · release notes
• https://github.com/yetanalytics/lrs/releases/tag/v1.2.17 release notes
• https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5 release notes