CVE-2024-41809 - OpenCVE

OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Openobserve	Openobserve

Configuration 1 [-]

cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32
https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02
https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d
https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp

History

Tue, 13 Aug 2024 14:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Openobserve Openobserve openobserve
CPEs		cpe:2.3:a:openobserve:openobserve::::::::
Vendors & Products		Openobserve Openobserve openobserve

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-07-25T20:22:14.726Z

Updated: 2024-08-12T20:57:41.387Z

Reserved: 2024-07-22T13:57:37.136Z

Link: CVE-2024-41809

Vulnrichment

Updated: 2024-08-02T04:46:52.701Z

NVD

Status : Analyzed

Published: 2024-07-25T21:15:11.310

Modified: 2024-08-13T13:43:51.613

Link: CVE-2024-41809

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-41809", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-07-22T13:57:37.136Z", "datePublished": "2024-07-25T20:22:14.726Z", "dateUpdated": "2024-08-12T20:57:41.387Z"}, "containers": {"cna": {"title": "OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp"}, {"name": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "tags": ["x_refsource_MISC"], "url": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02"}, {"name": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "tags": ["x_refsource_MISC"], "url": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d"}, {"name": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "tags": ["x_refsource_MISC"], "url": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32"}], "affected": [{"vendor": "openobserve", "product": "openobserve", "versions": [{"version": ">= 0.4.4, < 0.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-25T20:22:14.726Z"}, "descriptions": [{"lang": "en", "value": "OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html."}], "source": {"advisory": "GHSA-rw8w-37p9-mrrp", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "openobserve", "product": "openobserve", "cpes": ["cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.4.4", "status": "affected", "lessThan": "0.10.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-26T13:56:47.563924Z", "id": "CVE-2024-41809", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:57:41.387Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:52.701Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp"}, {"name": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02"}, {"name": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d"}, {"name": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "name": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "name": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "name": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "name": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:46:52.701Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-41809", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-26T13:56:47.563924Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*"], "vendor": "openobserve", "product": "openobserve", "versions": [{"status": "affected", "version": "0.4.4", "lessThan": "0.10.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-26T13:57:18.257Z"}}], "cna": {"title": "OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`", "source": {"advisory": "GHSA-rw8w-37p9-mrrp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openobserve", "product": "openobserve", "versions": [{"status": "affected", "version": ">= 0.4.4, < 0.10.0"}]}], "references": [{"url": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "name": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "name": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "name": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "name": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-25T20:22:14.726Z"}}}, "cveMetadata": {"cveId": "CVE-2024-41809", "state": "PUBLISHED", "dateUpdated": "2024-08-12T20:57:41.387Z", "dateReserved": "2024-07-22T13:57:37.136Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-07-25T20:22:14.726Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E05D552-02CC-47A9-A856-80D7A1208BE4", "versionEndExcluding": "0.10.0", "versionStartIncluding": "0.4.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html."}, {"lang": "es", "value": "OpenObserve es una plataforma de observabilidad de c\u00f3digo abierto. A partir de la versi\u00f3n 0.4.4 y anteriores a la versi\u00f3n 0.10.0, OpenObserve contiene una vulnerabilidad de Cross Site Scripting en la l\u00ednea 32 de `openobserve/web/src/views/MemberSubscription.vue`. La versi\u00f3n 0.10.0 sanitiza el HTML entrante."}], "id": "CVE-2024-41809", "lastModified": "2024-08-13T13:43:51.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-07-25T21:15:11.310", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}