x/vulndb: potential Go vuln in github.com/lf-edge/ekuiper: CVE-2024-52812

[GoVulnBot]

Advisory CVE-2024-52812 references a vulnerability in the following Go modules:

Module
github.com/lf-edge/ekuiper

Description:
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-52812
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809
• WEB: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824
• WEB: https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8
• WEB: GHSA-6hrw-x7pr-4mp8

Cross references:

• github.com/lf-edge/ekuiper appears in 1 other report(s):
  • data/reports/GO-2024-3078.yaml (x/vulndb: potential Go vuln in github.com/lf-edge/ekuiper: CVE-2024-43406 #3078)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/lf-edge/ekuiper
      vulnerable_at: 1.14.7
summary: CVE-2024-52812 in github.com/lf-edge/ekuiper
cves:
    - CVE-2024-52812
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52812
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809
    - web: https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824
    - web: https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8
    - web: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8
source:
    id: CVE-2024-52812
    created: 2025-03-10T19:01:18.908907713Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/657255 mentions this issue: data/reports: add 7 reports