Vulnerability Description
Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mmonit | Monit | < 5.25.3 |
| Canonical | Ubuntu Linux | 18.10 |
| Debian | Debian Linux | 8.0 |
| Fedoraproject | Fedora | 31 |
Related Weaknesses (CWE)
References
- https://bitbucket.org/tildeslash/monit/commits/1a8295eab6815072a18019b668fe08494PatchThird Party Advisory
- https://bitbucket.org/tildeslash/monit/commits/328f60773057641c4b2075fab9820145ePatchThird Party Advisory
- https://github.com/dzflack/exploits/blob/master/unix/monit_xss.pyExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00028.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00018.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3971-1/Third Party Advisory
- https://bitbucket.org/tildeslash/monit/commits/1a8295eab6815072a18019b668fe08494PatchThird Party Advisory
- https://bitbucket.org/tildeslash/monit/commits/328f60773057641c4b2075fab9820145ePatchThird Party Advisory
- https://github.com/dzflack/exploits/blob/master/unix/monit_xss.pyExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/04/msg00028.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00018.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2019-11454?
CVE-2019-11454 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized ...
How severe is CVE-2019-11454?
CVE-2019-11454 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11454?
Check the references section above for vendor advisories and patch information. Affected products include: Mmonit Monit, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora.