OpenObserve Fixes Cross-Site Scripting Vulnerability

CVE-2024-41809

6.1MEDIUM

Key Information

Vendor: Openobserve
Status: Openobserve
Vendor: CVE Published:; 25 July 2024

Summary

OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.

Affected Version(s)

openobserve = >= 0.4.4, < 0.10.0

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Risk change from: null to: 7.2 - (HIGH)
Jul 26, 2024
Vulnerability published.
Jul 25, 2024

Collectors

NVD DatabaseMitre Database