GitHub Advisoryadvisory · Maven
GHSA-7rw2-3hhp-rc46 Cross-site Scripting Vulnerability in Statement Browser
MEDIUM
Official page ↗
- Aliases
- CVE-2024-26140
- Ecosystem
- Maven
- Packages
- com.yetanalytics:lrs
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
- Weaknesses
- CWE-79
- Reviewed
- 2024-02-21
Affected packages
• Maven com.yetanalytics:lrs: < 1.2.17 → fixed in 1.2.17
Description
Impact
A maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser.
Patches
The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS.
Workarounds
No workarounds exist, we recommend upgrading to version 1.2.17 of the library or version 0.7.5 of SQL LRS immediately.
References
• LRS Tag
• LRS lib on Clojars
• SQL LRS 0.7.5 Release
Related
Alias · CVE (1)
- CVE-2024-26140 com.yetanalytics/lrs is the Yet Analytics Core LRS Library. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46 web
- https://nvd.nist.gov/vuln/detail/CVE-2024-26140 advisory
- https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621 web
- https://clojars.org/com.yetanalytics/lrs/versions/1.2.17 web
- https://github.com/yetanalytics/lrs package
- https://github.com/yetanalytics/lrs/releases/tag/v1.2.17 web
- https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5 web