PT-2019-15766 · Kairosdb · Kairosdb

K1Tten · Publicado 2019-11-17 · Atualizado 2022-11-03 · CVE-2019-19040

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KairosDB versions prior to 1.2.3

Description The issue concerns an XSS vulnerability in the view.html file due to the showErrorMessage function in js/graph.js. This can be exploited by including a specific substring, such as "sampling":{"value":"<script> in a query, for example, view.html?q=.

Recommendations For KairosDB versions prior to 1.2.3, as a temporary workaround, consider disabling the showErrorMessage function in js/graph.js until a patch is available. Restrict access to the view.html file to minimize the risk of exploitation. Avoid using the q parameter in the view.html endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19040

GHSA-FJHH-67WV-7GR4

Produtos afetados

Kairosdb

Referências · 6

• 🔥 https://github.com/kairosdb/kairosdb/issues/569 · Exploit
• https://github.com/kairosdb/kairosdb/milestone/10?closed=1 · Nota
• https://github.com/kairosdb/kairosdb/pull/593 · Nota
• https://osv.dev/vulnerability/GHSA-fjhh-67wv-7gr4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-19040 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19040 · Nota de Segurança