CVE-2024-52812 json
LF Edge eKuiper has Stored XSS in Rules Functionality
published 2025-03-10 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-54233 , GHSA-6hrw-x7pr-4mp8 , GO-2025-3508
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
Patch / fix
- go github.com/lf-edge/ekuiper/v2 2.0.8
- lfedge ekuiper 2.0.8
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250313T170021-1.1
opensuse advisories openSUSE-SU-2025:14893-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/lf-edge/ekuiper/v2 | <2.0.8 |
2.0.8 |
| go | github.com/lf-edge/ekuiper | <=1.14.7 all versions |
no fix listed |
Affected products
- lf-edge ekuiper
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8
web, advisory
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681
web
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716
web
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735
web
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794
web
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809
web
-
github.com
/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824
web
-
github.com
/lf-edge/ekuiper/releases/tag/v2.0.8
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-52812
advisory
-
github.com
/lf-edge/ekuiper
package
-
pkg.go.dev
/vuln/GO-2025-3508
web
Sources
- CVE List CVE-2024-52812
- GitHub Advisory GHSA-6hrw-x7pr-4mp8
- NVD CVE-2024-52812
- OSV GO-2025-3508
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.