CVE-2018-19334
MEDIUMGoogle Monorail < 2018-05-04 - Cross-Site Request Forgery via CSV Download
Title source: llmDescription
Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.
References (3)
Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.reddit.com/r/netsec/comments/9yiidf/xssearching_googles_bug_tracker_to_find_out/ea2i7wz/
Patch, Vendor Advisory x_refsource_misc
https://chromium.googlesource.com/infra/infra/+/77ef00cb53d90c9d1f984eca434d828de5c167a5
Various Sources x_refsource_misc
https://medium.com/%40luanherrera/xs-searching-googles-bug-tracker-to-find-out-vulnerable-source-code-50d8135b7549
Scores
CVSS v3
5.3
EPSS
0.0034
EPSS Percentile
26.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-352
Status
published
Products (1)
google/monorail
< 2018-05-04
Published
Nov 20, 2018
Tracked Since
Feb 18, 2026