com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
References
Configurations
Configuration 1 (hide)
|
History
05 Feb 2025, 22:34
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:yetanalytics:lrs:*:*:*:*:*:*:*:* cpe:2.3:a:yetanalytics:sql_lrs:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621 - Patch | |
| References | () https://clojars.org/com.yetanalytics/lrs/versions/1.2.17 - Release Notes | |
| References | () https://github.com/yetanalytics/lrs/releases/tag/v1.2.17 - Release Notes | |
| References | () https://github.com/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46 - Vendor Advisory | |
| References | () https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5 - Release Notes | |
| First Time |
Yetanalytics
Yetanalytics lrs Yetanalytics sql Lrs |
20 Feb 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-20 22:15
Updated : 2025-02-05 22:34
NVD link : CVE-2024-26140
Mitre link : CVE-2024-26140
JSON object : View
Products Affected
yetanalytics
- sql_lrs
- lrs
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')