// For flags

CVE-2024-26148

Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occur when an admin user unknowingly clicks on a cross-site scripting URL, thereby unintentionally compromising admin role access to the attacker. A patch to rectify this issue has been introduced in Querybook version `3.31.1`. The fix is backward compatible and automatically fixes existing DataDocs. There are no known workarounds for this issue, except for manually checking each URL prior to clicking on them.

Querybook es una interfaz de usuario para consultar big data. Antes de la versión 3.31.1, había una vulnerabilidad en el editor de texto enriquecido de Querybook que permitía a los usuarios ingresar URL arbitrarias sin someterse a la validación necesaria. Esta falla de seguridad particular permite el uso del protocolo `javascript:` que potencialmente puede desencadenar una ejecución arbitraria del lado del cliente. La explotación más extrema de esta falla podría ocurrir cuando un usuario administrador, sin saberlo, hace clic en una URL de Cross-Site Scripting, comprometiendo así involuntariamente el acceso de la función de administrador al atacante. Se introdujo un parche para rectificar este problema en la versión de Querybook `3.31.1`. La solución es compatible con versiones anteriores y corrige automáticamente los DataDocs existentes. No existen workarounds para este problema, excepto verificar manualmente cada URL antes de hacer clic en ellas.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-02-14 CVE Reserved
  • 2024-02-21 CVE Published
  • 2024-02-22 EPSS Updated
  • 2024-08-22 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pinterest
Search vendor "Pinterest"
 Querybook
Search vendor "Pinterest" for product "Querybook"
 < 3.31.1
Search vendor "Pinterest" for product "Querybook" and version " < 3.31.1"
en
Affected