PT-2025-10606 · Lf Edge · Lf Edge Ekuiper

Themostknown · Published 2025-03-10 · Updated 2025-03-15 · CVE-2024-52812

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LF Edge eKuiper versions prior to 2.0.8

Description The issue allows a user with modification rights to inject a cross-site scripting payload into the id parameter of a rule. When any user with access to the service makes modifications to the rule, the payload is executed in the victim's browser.

Recommendations For versions prior to 2.0.8, update to version 2.0.8 to resolve the issue. As a temporary workaround, consider restricting access to the rule modification functionality to minimize the risk of exploitation. Avoid using the id parameter in rules until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-52812

GHSA-6HRW-X7PR-4MP8

GO-2025-3508

OPENSUSE-SU-2025:14893-1

Affected Products

Lf Edge Ekuiper

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52812.json · Exploit
• https://osv.dev/vulnerability/GHSA-6hrw-x7pr-4mp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52812 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14893-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3508 · Vendor Advisory
• https://github.com/lf-edge/ekuiper · Note
• https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809 · Note
• https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716 · Note
• https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824 · Note