Medium severity · published Dec 3, 2024
CVE-2024-53257
Vitess allows HTML injection in /debug/querylogz & /debug/env
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
vitess · vitessio
>= 0.21.0-rc1, < 21.0.1; >= 0.20.0-rc1, < 20.0.4; < 19.0.8 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-53257
github.com
https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217
github.com
https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p
More from vitess
9.9
CVE-2026-27965
Vitess users with backup storage access can gain unauthorized access to production deployment environments
9.8
CVE-2026-104252
Vitess vttablet /twopcz reflected XSS
8.8
CVE-2026-27969
Vitess users with backup storage access can write to arbitrary file paths on restore
5.3
CVE-2026-65959
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data