CVE-2024-26140
CVSS V2 None
CVSS V3 None
Description
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
Overview
- CVE ID
- CVE-2024-26140
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-02-20T21:47:08.027Z
- Last Modified Date
- 2024-02-20T21:47:08.027Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46 | x_refsource_CONFIRM |
| https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621 | x_refsource_MISC |
| https://clojars.org/com.yetanalytics/lrs/versions/1.2.17 | x_refsource_MISC |
| https://github.com/yetanalytics/lrs/releases/tag/v1.2.17 | x_refsource_MISC |
| https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-26140 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26140 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-26 00:39:47 | Added to TrackCVE |