Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mamhoLTY3d3YtN2dyNM4AAvsI

Reflected Cross site scripting (XSS) in kairosdb

KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"' substring.

Permalink: https://github.com/advisories/GHSA-fjhh-67wv-7gr4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mamhoLTY3d3YtN2dyNM4AAvsI
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-fjhh-67wv-7gr4, CVE-2019-19040
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-19040
• https://github.com/kairosdb/kairosdb/issues/569
• https://github.com/kairosdb/kairosdb/pull/593
• https://github.com/kairosdb/kairosdb/milestone/10?closed=1
• https://github.com/advisories/GHSA-fjhh-67wv-7gr4

Repository: https://github.com/kairosdb/kairosdb
Blast Radius: 9.2

Affected Packages