PT-2019-19884 · Netdata+2 · Netdata+2

CVE-2019-9834 · Publicado 2019-03-15 · Atualizado 2024-08-04

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Netdata web application versions prior to 1.13.0

Description The issue allows remote attackers to inject malicious HTML code into an imported snapshot. Successful exploitation can lead to the execution of attacker-supplied HTML in the context of the affected browser. This potentially allows the attacker to steal authentication credentials or control how the site is rendered to the user.

Recommendations For versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue. As a temporary workaround, consider avoiding the import of snapshots from untrusted sources until a patch is applied. Restrict access to the snapshot import feature to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2019-1859

ALT-PU-2019-2565

CVE-2019-9834

Produtos afetados

Alt Linux

Debian

Netdata

Referências · 10

• 🔥 https://youtube.com/watch?v=zSG93yX0B8k · Exploit
• 🔥 https://exploit-db.com/exploits/46545 · Exploit
• https://github.com/netdata/netdata/issues/5800#issuecomment-510986112 · Nota
• https://osv.dev/vulnerability/CVE-2019-9834 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-9834 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9834 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9834 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-9834 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9834 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-9834 · Aviso do Fabricante