Reflected Cross site scripting (XSS) in kairosdb

MEDIUM 6.1CVE-2019-19040 · GHSA-fjhh-67wv-7gr4 · Published 17/11/2019 · updated 17/06/2026

In short

CVE-2019-19040 is a MEDIUM (CVSS 6.1) vulnerability affecting org.kairosdb:kairosdb, kairosdb (kairosdb project).
Chance of exploitation in the next 30 days (EPSS): 0.86%, higher than 58.7% of all vulnerabilities.
Fix: update to 1.3.0 or later.

Package	Affected versions	Patched versions
org.kairosdb:kairosdb Maven	`< 1.3.0`	`1.3.0`
kairosdb kairosdb_project	`≤ 1.2.2`	No fix yet

Description

KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.

NVD description

KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.

References

nvd.nist.gov/vuln/detail/CVE-2019-19040 · ADVISORY
kairosdb/kairosdb · WEB
kairosdb/kairosdb#593 · WEB
kairosdb/kairosdb · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free