CVE-2018-19335

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.1%
top 71.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Monorail
Timeline
PublishedNov 20
Latest updateMay 13

Description

Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages1 packages

▶NVDgoogle/monorail< 2018-06-07

Patches

Patch: chromium.googlesource.com ↗Patch: chromium.googlesource.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x7p2-7hrc-qqpx: Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of do↗2022-05-13
▶
CVEList
CVE-2018-19335: Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of do↗2018-11-20
▶
CVE-2018-19335 (MEDIUM CVSS 5.3) | Google Monorail before 2018-06-07 h | cvebase.io