CVE-2024-37674

What it actually does

The flaw permits stored cross-site scripting by failing to sanitize the name parameter when creating a new activity, allowing arbitrary script execution in victims' browsers.

Why it matters to the business

Attackers can hijack user sessions, steal data, or perform unauthorized actions inside the CMS, increasing risk of account compromise and operational disruption across learning environments.

How an attack unfolds

An authenticated attacker supplies a malicious script payload in the name field of a new activity; when another user views the activity the script runs in the browser context.

How to fix it

Upgrade affected installations to the fixed release 5.10.216-1 on Debian 11 systems.

How to confirm the fix worked

Confirm the deployed version matches a listed fixed release and verify that the name parameter is properly encoded or rejected on activity creation.

Typical attack path

1. Obtain a low-privileged account in the CMS
2. Create a new activity and embed a script payload in the name parameter
3. Share or cause a target user to view the activity page
4. Script executes to perform actions such as session theft or content manipulation

How to detect it

Inspect web server and application logs for activity creation requests containing script tags or encoded payloads in the name parameter; correlate with subsequent unexpected user actions.

What your security team should do

• Apply the vendor-supplied update to 5.10.216-1 without delay
• Review and harden input validation on all user-controlled activity fields
• Enable web application firewall rules that block common script patterns in form submissions
• Monitor authentication and activity-creation logs for anomalous payloads