CVE-2018-19335: CSRF
Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19335?
CVE-2018-19335 is considered a moderate severity vulnerability due to its potential for sensitive information disclosure.
How do I fix CVE-2018-19335?
To fix CVE-2018-19335, ensure that you upgrade Google Monorail to a version released after June 7, 2018.
What kind of vulnerability is CVE-2018-19335?
CVE-2018-19335 is a Cross-Site Search (XS-Search) vulnerability related to CSRF in CSV downloads.
What are the consequences of exploiting CVE-2018-19335?
Exploitation of CVE-2018-19335 could allow an attacker to gain unauthorized access to sensitive information contained in bug reports.
Who is affected by CVE-2018-19335?
CVE-2018-19335 affects users of Google Monorail prior to the June 7, 2018 update.