CVE-2023-36656 - jaeger-ui: xss allows an attacker to perform arbitrary jaeger queries and exfiltrate returned data

Back Back to CVE browser

MEDIUM

jaeger-ui: xss allows an attacker to perform arbitrary jaeger queries and exfiltrate returned data

Published Jul 17, 2023

5.7

MEDIUM

CVSS 3.1

EPSS 1.11%

Description

Cross Site Scripting (XSS) vulnerability in Jaegertracing Jaeger UI before v.1.31.0 allows a remote attacker to execute arbitrary code via the KeyValuesTable component.

Affected products

Red Hat Enterprise Linux 8

grafana

Not affected
Red Hat Enterprise Linux 9

grafana

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	grafana	Not affected	n/a
Red Hat Enterprise Linux 9	grafana	Not affected	n/a

Remediation

Red Hat statement

KeyValuesTable.tsx is only referenced by AccordianKeyValues.tsx, which does not reference the offending routine formatValue.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-80

References (7)

https://access.redhat.com/security/cve/CVE-2023-36656
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2225167
Issue Tracking
https://github.com/jaegertracing/jaeger-ui/pull/1498
PatchVendor Advisory
https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r
ExploitVendor Advisory
https://github.com/mafintosh/json-markup/pull/15
PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-36656
https://www.cve.org/CVERecord?id=CVE-2023-36656

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2023-36656		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2225167		Issue Tracking
https://github.com/jaegertracing/jaeger-ui/pull/1498		PatchVendor Advisory
https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r		ExploitVendor Advisory
https://github.com/mafintosh/json-markup/pull/15		PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-36656
https://www.cve.org/CVERecord?id=CVE-2023-36656