~ / search / GHSA-7rw2-3hhp-rc46

GHSA-7rw2-3hhp-rc46

Cross-site Scripting Vulnerability in Statement Browser

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-26140

Packages

EcosystemPackageAffectedFixed in
Maven com.yetanalytics:lrs < 1.2.17 1.2.17

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. ### Patches The problem is patched in version 1.2.17 of the LRS library and [version 0.7.5 of SQL LRS](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5). ### Workarounds No workarounds exist, we recommend upgrading to version 1.2.17 of the library or version 0.7.5 of SQL LRS immediately. ### References * [LRS Tag](https://github.com/yetanalytics/lrs/releases/tag/v1.2.17) * [LRS lib on Clojars](https://clojars.org/com.yetanalytics/lrs/versions/1.2.17) * [SQL LRS 0.7.5 Release](https://github.com/yetanalytics/lrsql/releases/tag/v0.7.5)

References

External links from the advisory. They lead to third-party sites.