CVEvulnerability
CVE-2019-9834
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-03-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot
Affected configurations
• netdata netdata (<= 1.13.0)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/netdata/netdata/issues/5800#issuecomment-510986112 Third Party Advisory
- https://www.exploit-db.com/exploits/46545 Exploit, Third Party Advisory, VDB Entry
- https://www.youtube.com/watch?v=zSG93yX0B8k Exploit, Third Party Advisory
- https://github.com/netdata/netdata/issues/5800#issuecomment-510986112 Third Party Advisory
- https://www.exploit-db.com/exploits/46545 Exploit, Third Party Advisory, VDB Entry
- https://www.youtube.com/watch?v=zSG93yX0B8k Exploit, Third Party Advisory