PT-2026-8239 · Arangodb · Arangodb Community Edition

Ozer Goker · CVE-2019-25367 · Publicado 2026-02-15 · Atualizado 2026-02-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ArangoDB Community Edition version 3.4.2-1

Description The ArangoDB Community Edition contains multiple cross-site scripting issues within the Aardvark web admin interface, specifically in the ‘index.html’ file. These issues are present in search functionality, user management features, and through various API parameters. An attacker can inject scripts via parameters in the / db/ system/ admin/aardvark/index.html endpoint, leading to the execution of JavaScript code within the browsers of authenticated users.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider carefully validating and sanitizing all user inputs to the / db/ system/ admin/aardvark/index.html endpoint. Restrict access to the Aardvark web admin interface to trusted users only.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25367

Produtos afetados

Arangodb Community Edition

Referências · 6

• 🔥 https://exploit-db.com/exploits/46407 · Exploit
• https://vulncheck.com/advisories/arangodb-community-edition-xss-via-aardvark-admin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25367 · Nota de Segurança
• https://t.me/CVEtracker/44761 · Publicação no Telegram
• https://t.me/cveNotify/152060 · Publicação no Telegram
• https://arangodb.com · Nota