XSS Vulnerability in Ganglia Web Frontend (ganglia-web) - CVE-2019-20379
Summary
DEBIAN-CVE-2019-20379: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ganglia Web Frontend, commonly referred to as ganglia-web, is a web-based interface for the Ganglia monitoring system, which is designed to monitor clusters and grids. It provides users with a graphical representation of the metrics collected from various nodes in a computing environment. The package is widely used in systems where performance monitoring is critical, but it has been found to be vulnerable to cross-site scripting (XSS) attacks, which can compromise the security of the application and its users.
Vulnerability Detail
The vulnerability identified as CVE-2019-20379 allows for cross-site scripting (XSS) through the 'cs' parameter in the header.php file of ganglia-web versions up to 3.7.5. This flaw can be exploited by an attacker to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, data theft, or other malicious activities. The issue arises from insufficient input validation and sanitization, making it critical for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, users should update the ganglia-web package to a patched version. The latest secure version can be installed using the following command in the terminal:
sudo apt-get update && sudo apt-get install ganglia-web
Ensure that your system is configured to receive updates from the appropriate repositories to obtain the latest version.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation on the 'cs' parameter in the header.php file to prevent the execution of malicious scripts. This can be done by sanitizing user inputs and ensuring that any data rendered on the page is properly escaped.
Conclusion
The CVE-2019-20379 vulnerability in ganglia-web poses a significant risk due to its potential for XSS attacks. Users are strongly encouraged to update their installations to the latest version to protect against exploitation. Implementing input validation can serve as a temporary measure while awaiting updates.
See every vulnerability recorded for ganglia-web →
FAQ
CVE-2019-20379 is a vulnerability in the ganglia-web package that allows for cross-site scripting (XSS) attacks through the 'cs' parameter in the header.php file.
If you are using ganglia-web version 3.7.5 or earlier, your system is vulnerable to this XSS attack. You can check your version using the command 'dpkg -l | grep ganglia-web'.
Exploitation of this vulnerability can lead to session hijacking, data theft, and unauthorized actions performed on behalf of users, compromising the security of the application.
Yes, a patched version of ganglia-web is available. Users should update to the latest version to mitigate the risk associated with this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. By using a manifest file like package-lock.json, Vulert can help you identify if your application is affected by vulnerabilities like CVE-2019-20379.
References
Related vulnerabilities
Recent vulnerabilities recorded for ganglia-web.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.