CVE-2024-47826

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-47826

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47826.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-47826

Aliases

GHSA-cjww-pr9f-4c4w

Published

2024-10-14T17:59:26.283Z

Modified

2025-12-05T06:41:45.159673Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L CVSS Calculator

Summary

eLabFTW vulnerable to HTML Injection in extended search error message

Details

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47826.json"
}

References

Affected packages

Git / github.com/elabftw/elabftw

Affected ranges

Type: GIT
Repo: https://github.com/elabftw/elabftw
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

86d493e2dd9275c3ffec48b31d707f65f84e8a93

Affected versions

0.*

0.10.0

0.10.0-RC

0.10.1

0.11.0

0.11.0-RC

0.11.0a

0.12.0

0.12.0-BETA

0.12.0-RC

0.12.1

0.12.2

0.12.3

0.12.4

0.12.5

0.12.6

0.7.0

0.7.1

0.7.2

0.7.3

0.7.3.1

0.7.3.2

0.8

0.8.1

0.8.2

0.8.3

0.9

0.9.1

0.9.1.1

0.9.1.2

0.9.4

0.9.4.2

0.9.5

1.*

1.0.0

1.0.0-alpha

1.0.0-beta

1.1.0

1.1.1

1.1.2

1.1.2-p1

1.1.3

1.1.4

1.1.4-p1

1.1.4-p2

1.1.4-p3

1.1.5

1.1.5-beta

1.1.5-p1

1.1.5-p2

1.1.6

1.1.7

1.1.8

1.1.8-p1

1.1.8-p2

1.2.0

1.2.0-alpha

1.2.0-beta

1.2.0-p1

1.2.0-p2

1.2.0-p3

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.3.0

1.3.1

1.4.0

1.4.1

1.4.2

1.4.3

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

2.*

2.0.0

2.0.0-alpha1

2.0.0-alpha2

2.0.0-beta

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.1.0-alpha

3.*

3.0.0

3.0.0-alpha

3.0.0-beta

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.1.2

3.2.0

3.2.1

3.2.2

3.3.0

3.3.1

3.3.10

3.3.11

3.3.12

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.3.9

3.4.0

3.4.0-alpha

3.4.0-beta

3.4.1

3.4.10

3.4.11

3.4.12

3.4.13

3.4.14

3.4.15

3.4.16

3.4.17

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

3.5.0

3.5.0-beta

3.5.0-rc

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.6.0

3.6.0-alpha

3.6.0-beta

3.6.0-rc

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

3.6.6

3.6.7

4.*

4.0.0

4.0.0-alpha

4.0.0-alpha2

4.0.0-beta

4.0.0-beta2

4.0.0-beta3

4.0.0-beta4

4.0.0-beta5

4.0.0-beta6

4.0.1

4.0.10

4.0.11

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

4.0.9

4.1.0

4.1.0-BETA

4.1.0-BETA2

4.1.0-BETA3

4.1.0-BETA4

4.1.0-BETA5

4.1.0-BETA6

4.2.0

4.2.0-BETA

4.2.1

4.2.2

4.2.3

4.2.4

4.3.0

4.3.0-alpha

4.3.0-beta

4.3.0-beta2

4.3.0-beta3

4.3.0-beta4

4.3.0-beta5

4.3.1

4.3.10

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

4.3.8

4.3.9

4.4.0

4.4.0-alpha

4.4.0-alpha2

4.4.0-alpha3

4.4.0-alpha4

4.4.0-alpha5

4.4.0-beta

4.4.0-beta2

4.4.0-beta3

4.4.0-beta4

4.4.0-beta5

4.4.0-beta6

4.4.0-beta7

4.4.1

4.4.2

4.4.3

4.5.0

4.5.0-beta

4.5.0-beta2

4.5.0-beta3

4.5.1

4.5.10

4.5.11

4.5.12

4.5.13

4.5.14

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.5.7

4.5.8

4.5.9

4.6.0

4.6.0-alpha

4.6.0-alpha2

4.6.0-alpha3

4.6.0-alpha4

4.6.0-beta

4.6.0-beta2

4.6.1

4.7.0

4.8.0

4.8.0-alpha

4.8.0-beta

4.8.1

4.8.2

4.8.3

4.8.4

4.8.5

4.8.6

4.9.0

4.9.0-alpha

4.9.0-beta

4.9.0-beta2

5.*

5.0.0

5.0.0-alpha

5.0.0-alpha2

5.0.0-alpha3

5.0.0-alpha4

5.0.0-beta

5.0.0-beta2

5.0.0-beta3

5.0.1

5.0.2

5.0.3

5.0.4

5.1.0

5.1.0-alpha

5.1.0-alpha2

5.1.0-alpha3

5.1.0-alpha4

5.1.0-beta

5.1.0-beta2

5.1.0-beta3

5.1.0-beta4

5.1.1

5.1.2

5.1.3

5.1.4