Description

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

INFO

Published Date :

2024-12-03T15:46:40.513Z

Last Modified :

2024-12-03T16:57:59.604Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-53257 vulnerability.

Vendors Products
Vitessio
  • Vitess
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-53257.

URL Resource
https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217 cve-icon cve-icon
https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact