CVE-2018-10099: CSRF
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10099?
CVE-2018-10099 is considered a medium severity vulnerability due to its potential impact on data confidentiality.
How do I fix CVE-2018-10099?
To fix CVE-2018-10099, update to a version of Google Monorail released after April 4, 2018.
What kind of vulnerability is CVE-2018-10099?
CVE-2018-10099 is a Cross-Site Search (XS-Search) vulnerability related to CSRF in CSV downloads.
Which versions of Google Monorail are affected by CVE-2018-10099?
CVE-2018-10099 affects all versions of Google Monorail prior to 2018-04-04.
What data could be exposed due to CVE-2018-10099?
CVE-2018-10099 could potentially expose sensitive information about the content of bug reports.