CVE-2024-52585

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to v CVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of s CVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to t CVE-2024-525892.7Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and throu CVE-2024-52595.4The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2024-525906.5Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows a CVE-2024-525919.3Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `Htt CVE-2024-525925.3Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an att CVE-2024-525935.3Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPer CVE-2024-525944.3Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content fro CVE-2024-525956.1lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxm CVE-2024-525968.8SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResp