CVE-2018-18837

概要

参考情報

• netdata/netdata · Third Party Advisory
• netdata/netdata commit 92327c9 · Patch
• netdata/netdata#4521 · Third Party Advisory
• red4sec.com/cve/netdata_header_injection.txt · Exploit

netdata のその他の脆弱性

• CVE-2018-18839中 5.3An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional.
• CVE-2018-18838高 7.5An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry.
• CVE-2018-18836中 6.5An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data…