Unrated severityNVD Advisory· Published Nov 20, 2018· Updated Aug 5, 2024

CVE-2018-10099

Description

Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Monorailinferred2 versions
<= 2018-04-04+ 1 more
- (no CPE)range: <= 2018-04-04
- (no CPE)range: < 2018-04-04

Patches

Vulnerability mechanics

References

chromium.googlesource.com/infra/infra/+/0ff6b6453b6192987bd9240c1e872a7de5fb1313mitrex_refsource_MISC
medium.com/%40luanherrera/xs-searching-googles-bug-tracker-to-find-out-vulnerable-source-code-50d8135b7549mitrex_refsource_MISC
www.reddit.com/r/netsec/comments/9yiidf/xssearching_googles_bug_tracker_to_find_out/ea2i7wz/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000