PT-2024-35382 · Autolab · Autolab

Jessehartloff · Published 2024-11-18 · Updated 2025-01-21 · CVE-2024-52585

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Autolab version 3.0.1

Description The issue concerns an HTML injection vulnerability that can affect instructors and CAs on the grade submissions page. This vulnerability is patched in version 3.0.2.

Recommendations For Autolab version 3.0.1, apply the patch manually by editing line 589 on gradesheet.js.erb to take in feedback as text rather than html.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-52585

GHSA-8QHP-JHHW-45R2

Affected Products

Autolab

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52585.json · Exploit
• https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2 · Vendor Advisory
• https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad9554c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-52585 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52585 · Vendor Advisory
• https://twitter.com/CVEnew/status/1858629197327196437 · Twitter Post
• https://t.me/cvedetector/11381 · Telegram Post