An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1603-1 advisory.

  - An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because     of web_client_api_request_v1_data in web/api/web_api_v1.c. (CVE-2018-18836)

  - An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename     parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. (CVE-2018-18837)

  - An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the     url parameter to api/v1/registry. (CVE-2018-18838)

  - ** DISPUTED ** An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via     api/v1/alarms. NOTE: the vendor says is intentional. (CVE-2018-18839)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
156215	openSUSE 15 Security Update : netdata (openSUSE-SU-2021:1603-1)	Nessus	SuSE Local Security Checks	Local	high
149569	openSUSE Security Update : netdata (openSUSE-2021-647)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2018-18839

medium

Tenable Plugins

high

high