Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2024-52585: Autolab grades page can run injected HTML
CVE-2024-52585 · published 1 year ago
Summary
The 3.0.1 version of Autolab lets an instructor or teaching assistant insert malicious HTML into the grade submissions page, which could change what users see or capture data. Updating to version 3.0.2 removes the problem, or you can manually edit line 589 in gradesheet.js.erb to treat feedback as plain text. Apply the update or patch promptly to keep the grading interface safe.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| autolabproject | autolab |
3.0.1 cpe:2.3:a:autolabproject:autolab:3.0.1:*:*:*:*:*:*:* |
Original advisory text
Autolab has HTML Injection Vulnerability
Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing line 589 on `gradesheet.js.erb` to take in feedback as text rather than html.
References
- https://github.com/autolab/Autolab/security/advisories/GHSA-8qhp-jhhw-45r2 Vendor Advisory
- https://github.com/autolab/Autolab/commit/2429983b6caa245fea1b37f0dc236ccbcad955... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52585... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-52585 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.0
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta