CVE-2024-41808

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available.

• CWE-79
• CWE-79

• https://github.com/openobserve/openobserve/security/advisories/GHSA-hx23-g7m8-h76jExploit, Mitigation, Vendor Advisory
• https://github.com/openobserve/openobserve/security/advisories/GHSA-hx23-g7m8-h76jExploit, Mitigation, Vendor Advisory

Published

Jul 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41802Xibo is a content management system (CMS). An SQL injection …8.1
• CVE-2024-41803Xibo is a content management system (CMS). An SQL injection …4.9
• CVE-2024-41804Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41805Tracks, a Getting Things Done (GTD) web application, is vuln…6.1
• CVE-2024-41806The Open edX Platform is a learning management platform. Ins…5.3
• CVE-2024-41807Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Co…
• CVE-2024-41809OpenObserve is an open-source observability platform. Starti…6.1
• CVE-2024-4181A command injection vulnerability exists in the RunGptLLM cl…8.8
• CVE-2024-41810Twisted is an event-based framework for internet application…6.1
• CVE-2024-41811ipl/web is a set of common web components for php projects. …3.9
• CVE-2024-41812txtdot is an HTTP proxy that parses only text, links, and pi…7.5
• CVE-2024-41813txtdot is an HTTP proxy that parses only text, links, and pi…7.5