Vulnerability · Published Nov 18, 2024 · Assigned by GitHub_M

CVE-2024-52585Autolab has HTML Injection Vulnerability

Low 1.2

In plain English

A low-severity cross-site scripting in Autolab from autolab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)1.2Low

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.

Affected products (as reported)

Vendor	Product	Versions
autolab	Autolab	= 3.0.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

References

https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2 x_refsource_CONFIRM
https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad9554c x_refsource_MISC