CVE-2024-41809

OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.
Configurations

Configuration 1 (hide)

cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*

History

13 Aug 2024, 13:43

Type Values Removed Values Added
CPE cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 7.2
v2 : unknown
v3 : 6.1
First Time Openobserve
Openobserve openobserve
References () https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32 - () https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32 - Product
References () https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02 - () https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02 - Patch
References () https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d - () https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d - Patch
References () https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp - () https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp - Third Party Advisory

26 Jul 2024, 12:38

Type Values Removed Values Added
Summary
  • (es) OpenObserve es una plataforma de observabilidad de código abierto. A partir de la versión 0.4.4 y anteriores a la versión 0.10.0, OpenObserve contiene una vulnerabilidad de Cross Site Scripting en la línea 32 de `openobserve/web/src/views/MemberSubscription.vue`. La versión 0.10.0 sanitiza el HTML entrante.

25 Jul 2024, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-25 21:15

Updated : 2024-08-13 13:43


NVD link : CVE-2024-41809

Mitre link : CVE-2024-41809

CVE.ORG link : CVE-2024-41809


JSON object : View

Products Affected

openobserve

  • openobserve
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')