Every CVE Search/ Get API key

CVE-2024-52290

Stored XSS in Configuration Key Functionality

6.3 MediumFix available

LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key Name (confKey) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.30%Up 0.3 points since May 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.3

Stored XSS in Configuration Key Functionality

LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key Name (confKey) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.

Record
CVE-2024-52290
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-54482 6.3

LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key Name (confKey) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.

Record
EUVD-2024-54482
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9cwv-pxcr-hfjc 6.3

LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality

Summary

Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.

Details

A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Connection Configuration key Name (confKey) parameter. Then, after any user with access to this service (e.g. admin) will try to delete this key, a payload will act in victim's browser.

PoC

  1. Authorize as a user with rights to modificate the service (e.g. kuiperUser role).
  2. Create a service or go to the existing one and access the Configuration > Connection page:

  1. Open any existing Connection and press on Add configuration key:

  1. Set any name and Address, then intercept the request and add the following payload to the confKey parameter: 123%3Cimg%20src=1%20onerror%3dalert%281%29%3E:

  1. A new configuration key then will be set:

  1. (Optional) You can authorize another user with access to this service. For nexe steps I will use admin user
  2. After we push on delete button (trash icon) opposite the created connection, the payload will work:

Impact

Stored Cross-site Scripting (XSS) vulnerability

Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone

Record
GHSA-9cwv-pxcr-hfjc
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.3

LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key Name (confKey) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.

Record
CVE-2024-52290
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.3

Stored XSS in Configuration Key Functionality

LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key Name (confKey) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.

Record
CVE-2024-52290
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-9cwv-pxcr-hfjc 6.3

LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality

Summary

Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.

Details

A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Connection Configuration key Name (confKey) parameter. Then, after any user with access to this service (e.g. admin) will try to delete this key, a payload will act in victim's browser.

PoC

  1. Authorize as a user with rights to modificate the service (e.g. kuiperUser role).
  2. Create a service or go to the existing one and access the Configuration > Connection page:

  1. Open any existing Connection and press on Add configuration key:

  1. Set any name and Address, then intercept the request and add the following payload to the confKey parameter: 123%3Cimg%20src=1%20onerror%3dalert%281%29%3E:

  1. A new configuration key then will be set:

  1. (Optional) You can authorize another user with access to this service. For nexe steps I will use admin user
  2. After we push on delete button (trash icon) opposite the created connection, the payload will work:

Impact

Stored Cross-site Scripting (XSS) vulnerability

Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone

Record
GHSA-9cwv-pxcr-hfjc
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGO-2025-3682 No score

LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality in github.com/lf-edge/ekuiper

LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality in github.com/lf-edge/ekuiper

Record
GO-2025-3682
Updated
2026-11-02
OSVopenSUSE-SU-2025:15135-1 No score

govulncheck-vulndb-0.0.20250515T200012-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250515T200012-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15135-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/lf-edge/ekuiper
Go
 through 1.14.7 None known
github.com/lf-edge/ekuiper/v2
Go
 before 2.1.0
2.1.0
github.com/lf-edge/ekuiper
Go
 All versions None known
govulncheck-vulndb
openSUSE:Tumbleweed
 before 0.0.20250515T200012-1.1
0.0.20250515T200012-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-52290 is a medium vulnerability (CVSS 6.3) in Lf-edge Ekuiper, published May 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in github.com/lf-edge/ekuiper/v2 2.1.0.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open