Vulnerability · Published Feb 20, 2024 · Assigned by GitHub_M
CVE-2024-26140com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser
Medium 4.6
In plain English
A medium-severity cross-site scripting in lrs from yetanalytics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.yetanalytics:lrs | 1.2.17 | GHSA-7rw2-3hhp-rc46 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yetanalytics | lrs | < 0.7.5< 1.2.17 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
References
- https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46 x_refsource_CONFIRM
- https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621 x_refsource_MISC
- https://clojars.org/com.yetanalytics/lrs/versions/1.2.17 x_refsource_MISC
- https://github.com/yetanalytics/lrs/releases/tag/v1.2.17 x_refsource_MISC
- https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5 x_refsource_MISC