This vulnerability (CVE-2024-52452) affects eduNEXT Open edX LMS through version 2.6.1 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as reflected cross-site scripting (XSS). It allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or other malicious actions. The CVSS 3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by eduNEXT, and the product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS vector indicates that the attack can be performed remotely over the network without privileges but requires user interaction. There are no known exploits in the wild currently.

As no official patch or remediation guidance is currently available from eduNEXT, users of Open edX LMS up to version 2.6.1 should monitor vendor communications for updates. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking suspicious links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.