PT-2025-21139 · Lf Edge · Ekuiper
Published
2025-05-14
·
Updated
2025-07-11
·
CVE-2024-52290
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
LF Edge eKuiper versions prior to 2.1.0
Description:
LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. A user with rights to modify the service, such as the kuiperUser role, can inject a cross-site scripting payload into the Connection Configuration key
Name (confKey) parameter. After this setup, when any user with access to this service, such as an admin, tries to delete this key, the payload acts in the victim's browser.Recommendations:
For versions prior to 2.1.0, update to version 2.1.0 to fix the issue. As a temporary workaround, consider restricting access to the Connection Configuration key to minimize the risk of exploitation. Avoid using the
Name (confKey) parameter in the affected Connection Configuration until the issue is resolved.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ekuiper