Google Monorail vulnerabilities

3 CVEs affecting Google Monorail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-19335, published 2018-11-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-19335, published 2018-11-20. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with a crafted groupby…
CVE-2018-19334, published 2018-11-20. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with an unsupported…
CVE-2018-10099, published 2018-11-20. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated…