Go/github.com/jaegertracing/jaeger: medium 6.5
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries
Action: Upgrade github.com/jaegertracing/jaeger to 1.47.0 or later.
go get github.com/jaegertracing/jaeger@v1.47.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.47.0 | - |
Fixed versions
| 1.47.0 |
Sources
- osv: GHSA-2w8w-qhg4-f78j
- https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r
- https://github.com/jaegertracing/jaeger/security/advisories/GHSA-2w8w-qhg4-f78j
- https://github.com/jaegertracing/jaeger
- https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49
published · modified · JSON