PT-2024-29575 · Unknown · Openobserve

Prabhatsharma · Published 2024-07-25 · Updated 2024-08-13 · CVE-2024-41809

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenObserve versions 0.4.4 through 0.9.x

Description OpenObserve is an open-source observability platform that contains a cross-site scripting issue in the openobserve/web/src/views/MemberSubscription.vue file, specifically in line 32. The issue is resolved in version 0.10.0, which sanitizes incoming html.

Recommendations For versions 0.4.4 through 0.9.x, update to version 0.10.0 to resolve the issue. As a temporary workaround, consider disabling the MemberSubscription.vue view until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41809

GHSA-RW8W-37P9-MRRP

Affected Products

Openobserve

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41809.json · Exploit
• https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d · Patch
• https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02 · Patch
• https://osv.dev/vulnerability/CVE-2024-41809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41809 · Security Note
• https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp · Note
• https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32 · Note
• https://t.me/cvenotify/90297 · Telegram Post
• https://t.me/cvedetector/1653 · Telegram Post