Medium severity5.3NVD Advisory· Published Nov 20, 2018· Updated Jun 17, 2026

CVE-2018-10099

Description

Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Monorailinferred3 versions
<= 2018-04-04+ 2 more
- (no CPE)range: <= 2018-04-04
- cpe:2.3:a:google:monorail:*:*:*:*:*:*:*:*range: <2018-04-04
- (no CPE)range: <2018-04-04

Patches

Vulnerability mechanics

References

chromium.googlesource.com/infra/infra/+/0ff6b6453b6192987bd9240c1e872a7de5fb1313nvdPatchVendor Advisory
www.reddit.com/r/netsec/comments/9yiidf/xssearching_googles_bug_tracker_to_find_out/ea2i7wz/nvdExploitThird Party Advisory
medium.com/%40luanherrera/xs-searching-googles-bug-tracker-to-find-out-vulnerable-source-code-50d8135b7549nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000