Every CVE Search/ Get API key

CVE-2019-11454

Cross-site scripting

6.1 MediumFix available

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.41%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
CVE-2019-11454
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
CVE-2019-11454
Updated
2026-11-02
EUVDEUVD-2019-3129 No score

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
EUVD-2019-3129
Updated
2026-11-03
GitHub AdvisoriesGHSA-8hqm-hwvr-wgv7 6.1

Cross-site scripting

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
GHSA-8hqm-hwvr-wgv7
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2019-11454 6.1

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
ALPINE-CVE-2019-11454
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 6.1

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
CVE-2019-11454
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2019-11454 6.1

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
DEBIAN-CVE-2019-11454
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11454 6.1

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.

Record
UBUNTU-CVE-2019-11454
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2019-0246 No score

Updated monit packages fix security vulnerabilities

Updated monit package fixes security vulnerabilities:

Zack Flack discovered that Monit incorrectly handled certain input. A remote authenticated user could exploit this to conduct cross-site scripting (XSS) attacks (CVE-2019-11454).

Zack Flack discovered a buffer overread when Monit decoded certain crafted URLs. An attacker could exploit this to leak potentially sensitive information (CVE-2019-11455).

Record
MGASA-2019-0246
Updated
2026-11-02
OSVUSN-4860-1 No score

monit vulnerabilities

Zack Flack discovered that Monit incorrectly handled certain input. A remote authenticated user could exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2019-11454)

Zack Flack discovered a buffer overread when Monit decoded certain crafted URLs. An attacker could exploit this to potentially leak sensitive information. (CVE-2019-11455)

Record
USN-4860-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
monit
Alpine:v3.7
 before 5.24.0-r2
5.24.0-r2
monit
Alpine:v3.8
 before 5.25.2-r0
5.25.2-r0
monit
Alpine:v3.9
 before 5.25.2-r1
5.25.2-r1
monit
Debian:12
 before 1:5.25.3-1
1:5.25.3-1
monit
Debian:13
 before 1:5.25.3-1
1:5.25.3-1
monit
Debian:14
 before 1:5.25.3-1
1:5.25.3-1
monit
Debian:8
From an advisory covering 2 CVEs
 before 1:5.9-1+deb8u2, plus listed versions
1:5.9-11:5.9-1+deb8u1
1:5.9-1+deb8u2
monit
Debian:9
From an advisory covering 2 CVEs
 before 1:5.20.0-6+deb9u2, plus listed versions
1:5.20.0-61:5.20.0-6+deb9u1
1:5.20.0-6+deb9u2
monit
Mageia:6
From an advisory covering 2 CVEs
 before 5.25.3-1.1.mga6
5.25.3-1.1.mga6
monit
Ubuntu:Pro:14.04:LTS
 before 1:5.6-2ubuntu0.1+esm2, plus listed versions
1:5.5.1-11:5.6-11:5.6-21:5.6-2ubuntu0.1
1:5.6-2ubuntu0.1+esm2
Show 5 moreShow less
Affected packages
PackageAffectedFixed
monit
Ubuntu:Pro:16.04:LTS
 before 1:5.16-2ubuntu0.2+esm1, plus listed versions
1:5.14-21:5.15-11:5.15-21:5.15-31:5.16-11:5.16-21:5.16-2ubuntu0.11:5.16-2ubuntu0.2
1:5.16-2ubuntu0.2+esm1
monit
Ubuntu:Pro:18.04:LTS
 before 1:5.25.1-1ubuntu0.1~esm1, plus listed versions
1:5.23.0-21:5.23.0-41:5.25.1-11:5.25.1-1build1
1:5.25.1-1ubuntu0.1~esm1
monit
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 1:5.6-2ubuntu0.1+esm2, plus listed versions
1:5.5.1-11:5.6-11:5.6-21:5.6-2ubuntu0.1
1:5.6-2ubuntu0.1+esm2
monit
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 1:5.16-2ubuntu0.2+esm1, plus listed versions
1:5.14-21:5.15-11:5.15-21:5.15-31:5.16-11:5.16-21:5.16-2ubuntu0.11:5.16-2ubuntu0.2
1:5.16-2ubuntu0.2+esm1
monit
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 1:5.25.1-1ubuntu0.1~esm1, plus listed versions
1:5.23.0-21:5.23.0-41:5.25.1-11:5.25.1-1build1
1:5.25.1-1ubuntu0.1~esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11454 is a medium vulnerability (CVSS 6.1) in Mmonit Monit, published April 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.41%, the 84th percentile. Fixed in monit 5.24.0-r2.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open