CVE-2018-10099

5.3MEDIUM

Key Information:

Vendor
Google
Status
Monorail
Vendor
CVE Published:
20 November 2018

Summary

Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.

References

https://chromium.googlesource.com/infra/infra/+/0ff6b6453...
x_refsource_MISC
https://www.reddit.com/r/netsec/comments/9yiidf/xssearchi...
x_refsource_MISC
https://medium.com/%40luanherrera/xs-searching-googles-bu...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.