CVE-2018-19335: Google Monorail

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby value) can be used to obtain sensitive information about the content of bug reports.

Affected products

• Google Monorail: before 2018-06-07 (fixed in 2018-06-07)

Published 2018-11-20. Last modified 2026-06-17.