$ cve CVE-2019-9834 JSON

CVE-2019-9834 EXPLOIT

6.1

MEDIUM · CVSS 3.0 · EPSS 6.2% (pctl 93)

Patch early

A public exploit exists.

Description

The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot

Scoring

CVSS	6.1 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS	6.16% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2019-03-15
Last modified	2026-06-17

Affected (1)

Vendor	Product
netdata	netdata

Public exploits

Source	Title	Date
exploit-db	NetData 1.13.0 - HTML Injection	2019-03-15

References

→ the Explorer · watch your stack · NVD