CVE-2018-18836

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L388Exploit, Third Party Advisory
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L403Exploit, Third Party Advisory
https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97caPatch, Third Party Advisory
https://github.com/netdata/netdata/pull/4521Third Party Advisory
https://www.red4sec.com/cve/netdata_json_injection.txtThird Party Advisory
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L388Exploit, Third Party Advisory
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L403Exploit, Third Party Advisory
https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97caPatch, Third Party Advisory
https://github.com/netdata/netdata/pull/4521Third Party Advisory
https://www.red4sec.com/cve/netdata_json_injection.txtThird Party Advisory

Timeline

Published: Jun 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-188376.1An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_req CVE-2018-188387.5An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry.CVE-2018-188395.3An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional.CVE-2018-18847.8IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerable to a "zip slip" vulnerability which could allow a re CVE-2018-188405.4XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter.CVE-2018-188414.8XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter.CVE-2018-188428.8CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP CVE-2018-1884310.0The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.CVE-2018-188456.1internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, version 1.0, contain a CVE-2018-188495.5In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.CVE-2018-18855.3IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information usi CVE-2018-188508.8In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could uplo