CVE-2024-53257: Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly…

PriorityP424medium4.9CVSS 3.1

AVNACLPRHUINSUCNIHAN

EPSS

0.43%

34.2th percentile

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
msrc	azl3_vitess_19.0.4-7_on_azure_linux_3.0	—	—
msrc	cbl2_vitess_17.0.7-6_on_cbl_mariner_2.0	—	—
msrc	cbl2_vitess_17.0.7-8_on_cbl_mariner_2.0	—	—
vitess.io	vitess	>= 0 < 0.19.8	0.19.8
vitess.io	vitess	>= 0.20.0 < 0.20.4	0.20.4
vitess.io	vitess	>= 0.20.0-rc1 < 0.20.4	0.20.4
vitess.io	vitess	>= 0.21.0 < 0.21.1	0.21.1
vitess.io	vitess	>= 0.21.0-rc1 < 0.21.1	0.21.1
vitessio	vitess	< 19.0.8	19.0.8
vitessio	vitess	—	—
vitessio	vitess	—	—

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

vendor_msrc4.9MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.