CVE-2024-51380

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-51380

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51380.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-51380

Published

2024-11-05T00:00:00Z

Modified

2026-07-15T01:48:54.435184779Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaScript into the properties section of a study, specifically within the UUID field. When an admin user accesses the study's properties, the injected script is executed in the admin's browser, which could lead to unauthorized actions, including account compromise and privilege escalation.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51380.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/jatos/jatos

Affected ranges

Type

GIT

Repo

https://github.com/jatos/jatos

Events

Introduced

694d15402ee5e3853f05f48ffe38bb612e7a1804

Last affected

694d15402ee5e3853f05f48ffe38bb612e7a1804

Database specific

{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.9.3"
        },
        {
            "last_affected": "3.9.3"
        }
    ],
    "cpe": "cpe:2.3:a:jatos:jatos:3.9.3:*:*:*:*:*:*:*"
}

Affected versions

3.*

3.9.3

v3.*

v3.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51380.json"