VDB
GHSA-2w8w-qhg4-f78j
GHSA-2w8w-qhg4-f78j
PUBLISHED
CVSS 6.5 MEDIUM
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | telegraf-1.26 | * |
| chainguard | plutono | * |
| chainguard | plutono-fips | * |
| github.com | jaegertracing/jaeger | 0 |
| wolfi | telegraf-1.26 | * |
| Go | github.com/jaegertracing/jaeger | 0 |
| github.com | jaegertracing/jaeger | 0 |
Timeline
- Jul 11, 2023 CVE Published
References
- https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r url
- GitHub Advisory GHSA-2w8w-qhg4-f78j vendor-advisory
- https://github.com/jaegertracing/jaeger package
- https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49 url
- https://github.com/jaegertracing/jaeger/security/advisories/GHSA-2w8w-qhg4-f78j url