CVE-2019-5457

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
min-http-server	min-http-server	Not Fixed

References

https://hackerone.com/reports/570568Exploit, Third Party Advisory
https://hackerone.com/reports/570568Exploit, Third Party Advisory

Timeline

Published: Jul 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54585.4Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exec CVE-2019-54597.1An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.CVE-2019-54605.5Double Free in VLC versions <= 3.0.6 leads to a crash.CVE-2019-54613.5An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary CVE-2019-54628.8A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has cha CVE-2019-54635.3An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. Thi CVE-2019-54649.8A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF whe CVE-2019-54654.3An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclos CVE-2019-54664.3An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names.CVE-2019-54675.4An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. CVE-2019-54688.8An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used wi CVE-2019-54696.5An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other