{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26140", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-02-14T17:40:03.688Z", "datePublished": "2024-02-20T21:47:08.027Z", "dateUpdated": "2024-08-01T23:59:32.684Z"}, "containers": {"cna": {"title": "com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46"}, {"name": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621", "tags": ["x_refsource_MISC"], "url": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621"}, {"name": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17", "tags": ["x_refsource_MISC"], "url": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17"}, {"name": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17", "tags": ["x_refsource_MISC"], "url": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17"}, {"name": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5"}], "affected": [{"vendor": "yetanalytics", "product": "lrs", "versions": [{"version": "< 0.7.5", "status": "affected"}, {"version": "< 1.2.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-20T21:47:08.027Z"}, "descriptions": [{"lang": "en", "value": "com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist."}], "source": {"advisory": "GHSA-7rw2-3hhp-rc46", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T20:38:15.549793Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:53.235Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:59:32.684Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46"}, {"name": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621"}, {"name": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17"}, {"name": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17"}, {"name": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T20:38:15.549793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:40.475Z"}}], "cna": {"title": "com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser", "source": {"advisory": "GHSA-7rw2-3hhp-rc46", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "yetanalytics", "product": "lrs", "versions": [{"status": "affected", "version": "< 0.7.5"}, {"status": "affected", "version": "< 1.2.17"}]}], "references": [{"url": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46", "name": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621", "name": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621", "tags": ["x_refsource_MISC"]}, {"url": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17", "name": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17", "name": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5", "name": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-02-20T21:47:08.027Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26140", "state": "PUBLISHED", "dateUpdated": "2024-07-05T17:21:53.235Z", "dateReserved": "2024-02-14T17:40:03.688Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-02-20T21:47:08.027Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yetanalytics:lrs:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA215B85-84E9-4032-A0B1-BEA4B6F27F5D", "versionEndExcluding": "1.2.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:yetanalytics:sql_lrs:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB697355-88AA-48FC-A35B-FCABBB7B16DA", "versionEndExcluding": "0.7.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist."}, {"lang": "es", "value": "com.yetanalytics/lrs es la librer\u00eda LRS principal de Yet Analytics. Antes de la versi\u00f3n 1.2.17 de la librer\u00eda LRS y la versi\u00f3n 0.7.5 de SQL LRS, se pod\u00eda utilizar una declaraci\u00f3n xAPI creada con fines malintencionados para realizar una inyecci\u00f3n de script u otras etiquetas en el navegador de declaraciones LRS. El problema se solucion\u00f3 en la versi\u00f3n 1.2.17 de la librer\u00eda LRS y en la versi\u00f3n 0.7.5 de SQL LRS. No existen workarounds conocidas."}], "id": "CVE-2024-26140", "lastModified": "2025-02-05T22:34:32.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-20T22:15:08.950", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://clojars.org/com.yetanalytics/lrs/versions/1.2.17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/yetanalytics/lrs/releases/tag/v1.2.17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}