CVE-2024-53257CWE-79

Vitess allows HTML injection in /debug/querylogz & /debug/env

Medium · published December 3, 2024

CVSS v3.1
4.9
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-12-03T15:46Z
EPSS history
Timeline
  • 03 DEC 15:46Z
    Vitess allows HTML injection in /debug/querylogz & /debug/env
    cvelistv5