6.1

UBUNTU-CVE-2019-9834: netdata Ubuntu

CVSS: 6.1v3.0MediumPublished
Published 15-03-2019Last modified 15-03-2019
Open JSON

Vulnerability summary

UBUNTU-CVE-2019-9834 is a medium (CVSS 6.1) vulnerability in netdata Ubuntu.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.0 (OSV · Ubuntu), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-03-2019
    PublishedVulnerability first disclosed.

Description

** DISPUTED ** The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu1 product
  • netdataAll versions (No fix recorded)

1 vendor · 1 product

References

5 links