CVE-2019-3911

Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.

Score

CVSS 3.1 6.1 Medium

Status

Modified - vulnreport@tenable.com

Published

2019-01-30

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Labkey Server (Labkey)
• Labkey Server Community Edition (Tenable)

References

• https://www.tenable.com/security/research/tra-2019-03