Detections
Analytics

Alpine: monit: security update to 5.24.0-r2

high Tenable Cloud Security Plugin ID 405594

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote
 unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field
 of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog
 operation. (CVE-2019-11454)

 - A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote
 authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST
 parameters. The attacker can also cause a denial of service (application outage). (CVE-2019-11455)

See Also

https://security.alpinelinux.org/vuln/CVE-2019-11454

https://security.alpinelinux.org/vuln/CVE-2019-11455

Plugin Details

Severity: High

ID: 405594

Version: Revision 1.24

Type: Local

Published: 10/31/2023

Updated: 3/13/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:P

CVSS Score Source: CVE-2019-11455

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 4/22/2019

Reference Information

CVE: CVE-2019-11454, CVE-2019-11455