{"id":"CVE-2019-11454","details":"Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.","modified":"2026-07-08T15:54:36.770773Z","published":"2019-04-22T16:29:01.490Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.10"},{"last_affected":"18.10"},{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"31"},{"last_affected":"31"},{"introduced":"32"},{"last_affected":"32"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZQDHRSKTEX5MSYXNCGFTUSFGANBARHX/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L475QJMFFI2QV5QEHAKKPVX6QX6ECUL6/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00028.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00018.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3971-1/"},{"type":"FIX","url":"https://bitbucket.org/tildeslash/monit/commits/1a8295eab6815072a18019b668fe084945b751f3"},{"type":"FIX","url":"https://bitbucket.org/tildeslash/monit/commits/328f60773057641c4b2075fab9820145e95b728c"},{"type":"EVIDENCE","url":"https://github.com/dzflack/exploits/blob/master/unix/monit_xss.py"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://bitbucket.org/tildeslash/monit","events":[{"introduced":"0"},{"fixed":"e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9"},{"fixed":"1a8295eab6815072a18019b668fe084945b751f3"},{"fixed":"328f60773057641c4b2075fab9820145e95b728c"}],"database_specific":{"cpe":"cpe:2.3:a:mmonit:monit:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.25.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["release-5-25-2","release-5-25-1","release-5-25-0","release-5-24-0","release-5-23-0","release-5-20-0","release-5-19-0","release-5-18-0","release-5-17-1","release-5-17-0","release-5-16-0","release-5-15-0","release-5-14-0","release-5-13-0","release-5-12-2","release-5-12-1","release-5-12-0","release-5-11-0","release-5-8-1","release-5-8","release-5-7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11454.json","vanir_signatures_modified":"2026-07-08T15:54:36Z","vanir_signatures":[{"source":"https://bitbucket.org/tildeslash/monit@328f60773057641c4b2075fab9820145e95b728c","target":{"file":"src/http/cervlet.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["192760338526727209623324117128154017375","176363103172019343482822146618895062539","268951090696583617304681140437510744709","59623480104490707459496006942355571950"]},"id":"CVE-2019-11454-0dc3f653","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"23861697072258711609888231435936520561","length":648},"id":"CVE-2019-11454-13a9ad76","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9","target":{"file":"src/http/cervlet.c","function":"do_foot"}},{"signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9","target":{"file":"src/monit.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335804617024891229671540928535154829375","310100624601859608845471492265078988370","154807492576191686414917484984983555220","87379780001120515149930474484174954645"]},"id":"CVE-2019-11454-16367172"},{"deprecated":false,"digest":{"function_hash":"287019773174119488372765190948736526793","length":598},"id":"CVE-2019-11454-4c95ae77","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9","target":{"file":"src/monit.c","function":"version"}},{"deprecated":false,"digest":{"function_hash":"309952375732884078430535276969002257337","length":1433},"id":"CVE-2019-11454-79ed33e1","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9","target":{"function":"do_about","file":"src/http/cervlet.c"}},{"deprecated":false,"digest":{"line_hashes":["83469158976872561554671678004370611577","231063324253302383638823170907697343759","266168777303464530820275752220424199435","234939084648347694763319377839068928997","271084292119558296088722602634243413305","72830479874841803587946559619711045487"],"threshold":0.9},"id":"CVE-2019-11454-9093b3ec","signature_type":"Line","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@e9e458ae169c1155cdcd9ca956c0cb4b8d5614f9","target":{"file":"src/http/cervlet.c"}},{"target":{"file":"src/http/cervlet.c","function":"do_viewlog"},"deprecated":false,"digest":{"function_hash":"316469937887899855624336538781855417458","length":1120},"id":"CVE-2019-11454-a558f63e","signature_type":"Function","signature_version":"v1","source":"https://bitbucket.org/tildeslash/monit@328f60773057641c4b2075fab9820145e95b728c"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}