PT-2019-15766 · Kairosdb · Kairosdb

K1Tten · Published 2019-11-17 · Updated 2022-11-03 · CVE-2019-19040

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KairosDB versions prior to 1.2.3

Description The issue concerns an XSS vulnerability in the view.html file due to the showErrorMessage function in js/graph.js. This can be exploited by including a specific substring, such as "sampling":{"value":"<script> in a query, for example, view.html?q=.

Recommendations For KairosDB versions prior to 1.2.3, as a temporary workaround, consider disabling the showErrorMessage function in js/graph.js until a patch is available. Restrict access to the view.html file to minimize the risk of exploitation. Avoid using the q parameter in the view.html endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19040

GHSA-FJHH-67WV-7GR4

Affected Products

Kairosdb

References · 6

• 🔥 https://github.com/kairosdb/kairosdb/issues/569 · Exploit
• https://osv.dev/vulnerability/GHSA-fjhh-67wv-7gr4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19040 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19040 · Security Note
• https://github.com/kairosdb/kairosdb/milestone/10?closed=1 · Note
• https://github.com/kairosdb/kairosdb/pull/593 · Note