Medium severity5.3NVD Advisory· Published Nov 20, 2018· Updated Jun 17, 2026

CVE-2018-19334

Description

Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported axis) can be used to obtain sensitive information about the content of bug reports.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Google/Monorailinferred3 versions
<2018-05-04+ 2 more
- (no CPE)range: <2018-05-04
- cpe:2.3:a:google:monorail:*:*:*:*:*:*:*:*range: <2018-05-04
- (no CPE)range: <2018-05-04

Patches

Vulnerability mechanics

References

chromium.googlesource.com/infra/infra/+/77ef00cb53d90c9d1f984eca434d828de5c167a5nvdPatchVendor Advisory
www.reddit.com/r/netsec/comments/9yiidf/xssearching_googles_bug_tracker_to_find_out/ea2i7wz/nvdExploitThird Party Advisory
medium.com/%40luanherrera/xs-searching-googles-bug-tracker-to-find-out-vulnerable-source-code-50d8135b7549nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000