CVE-2024-26140mediumCWE-79

CVE-2024-26140: fallo de gravedad media en yetanalytics lrs

com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser

Publicada el · Actualizada el

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.6epss 0.4%
probabilidad de explotación
0.4%top 63% de las CVE
explotación observada
noninguna fuente lo reporta
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Productos afectados
yetanalytics · lrs
Referencias
https://clojars.org/com.yetanalytics/lrs/versions/1.2.17https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5https://github.com/yetanalytics/lrs/releases/tag/v1.2.17https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46