CVE-2019-9834: XSS
DISPUTED The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9834?
CVE-2019-9834 has been classified as a potentially high severity vulnerability due to its capability for HTML Injection.
How do I fix CVE-2019-9834?
To mitigate CVE-2019-9834, upgrade the Netdata application to version 1.14.0 or later.
What types of attacks can CVE-2019-9834 facilitate?
CVE-2019-9834 can facilitate attacks like Cross-Site Scripting (XSS) by allowing remote attackers to inject malicious HTML code.
Which versions of Netdata are affected by CVE-2019-9834?
CVE-2019-9834 affects all versions of Netdata up to and including 1.13.0.
Is CVE-2019-9834 easy to exploit?
Exploitation of CVE-2019-9834 may be relatively easy for attackers with knowledge of HTML and access to the vulnerable application.