CVE-2024-53257

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-532585.3Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can d CVE-2024-532596.5quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected qui CVE-2024-53268.8The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due CVE-2024-532606.8Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to i CVE-2024-532615.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* CVE-2024-532625.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors CVE-2024-532638.5Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of t CVE-2024-532645.1bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint CVE-2024-532665.4Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled CVE-2024-532675.5sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situ CVE-2024-532688.8Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected ver CVE-2024-532697.5Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs so