CVE-2024-51379

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-51379

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51379.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-51379

Published

2024-11-05T00:00:00Z

Modified

2026-08-12T03:51:18.532223844Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where an attacker can inject JavaScript into the description field. This allows for the execution of malicious scripts when an admin views the description, potentially leading to account takeover and unauthorized actions.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51379.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/jatos/jatos

Affected ranges

Type

GIT

Repo

https://github.com/jatos/jatos

Events

Introduced

694d15402ee5e3853f05f48ffe38bb612e7a1804

Last affected

694d15402ee5e3853f05f48ffe38bb612e7a1804

Database specific

Show details

{
    "cpe": "cpe:2.3:a:jatos:jatos:3.9.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.9.3"
        },
        {
            "last_affected": "3.9.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.9.3

v3.*

v3.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51379.json"