Medium severity · published Jul 25, 2024
CVE-2024-41809
OpenObserve is an open-source observability platform
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openobserve · Openobserve
0.4.4 before 0.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41809
Product
https://github.com/openobserve/openobserve/blob/v0.5.2/web/src/views/MemberSubscription.vue#L32
Patch
https://github.com/openobserve/openobserve/commit/2334377ebc8b74beb06ab3e5712dbdb1be1eff02
Patch
https://github.com/openobserve/openobserve/commit/64587261968217dfb8af4c4f6054d58bbc6d331d
Third Party Advisory
https://github.com/openobserve/openobserve/security/advisories/GHSA-rw8w-37p9-mrrp
More from Openobserve
8.8
CVE-2024-24830
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale
8.4
CVE-2025-66223
OpenObserve's Invite Token Lifecycle Misconfiguration
7.7
CVE-2026-39361
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
7.5
CVE-2026-63645
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
6.5
CVE-2024-25106
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale