Back to Database
Status published
Low
CVE-2024-52585
Autolab has HTML Injection Vulnerability
Vulnerability Description
Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52585
Credits & Attribution
No credits recorded in the NVD database.
References
More from autolab
View All →CVE-2024-53260
Course Roster vulnerable to CSV Injection in Autolab
Medium
6.8
CVE-2024-53258
download_all_submissions allows student to download another student's submissions in Autolab
High
7.1
CVE-2024-52584
Autolab has vulnerable submission endpoints
Medium
4.9
CVE-2024-49376
Autolab Has Misconfigured Reset Password Permissions
High
7.1
CVE-2023-44395
Autolab has Path Traversal vulnerability in Assessment functionality
Medium
4.9
Affected Vendor
autolab
View all reports →Affected Software
Autolab
Vulnerable Versions:
= 3.0.1
Timeline
Official Publish:
November 18th, 2024
Last Modified:
November 21st, 2024
Added to House:
July 22nd, 2026