CVE-2024-26140 json
com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser
published 2024-02-20 2 y ago modified 2026-09-10 1 mo ago also GHSA-7rw2-3hhp-rc46 , EUVD-2024-0562
- cvss
- 4.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
Patch / fix
- maven com.yetanalytics:lrs 1.2.17
- yetanalytics lrs 1.2.17
- yetanalytics sql_lrs 0.7.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.yetanalytics:lrs | <1.2.17 |
1.2.17 |
Affected products
- yetanalytics lrs
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/yetanalytics/lrs/commit/d7f4883bc2252337d25e8bba2c7f9d172f5b0621
web, patch
-
github.com
/yetanalytics/lrs/security/advisories/GHSA-7rw2-3hhp-rc46
web, vendor-advisory
-
clojars.org
/com.yetanalytics/lrs/versions/1.2.17
web, product, release-notes
-
github.com
/yetanalytics/lrs/releases/tag/v1.2.17
web, release-notes
-
github.com
/yetanalytics/lrsql/releases/tag/v0.7.5
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-26140
advisory
-
github.com
/yetanalytics/lrs
package
Sources
- CVE List CVE-2024-26140
- GitHub Advisory GHSA-7rw2-3hhp-rc46
- NVD CVE-2024-26140
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.