Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery status records, suppress alerts, and corrupt audit trails. The codebase already implements proper signature verification for Slack webhooks. Details Vulnerable code — App/FeatureSet/Notification/API/WhatsApp.ts lines 372-430: Compare with the Slack webhook which correctly validates signatures: Common/Server/Middleware/SlackAuthorization.ts line 58: The WhatsApp GET webhook correctly validates the verify token — only the POST handler (which processes actual events) is missing signature verification. No existing CVEs cover webhook signature verification issues in OneUptime. The closest is GHSA-cw6x-mw64-q6pv (WhatsApp Resend Verification Auth Bypass), which is about a different WhatsApp-related…
Recommended action: Upgrade to 10.0.34 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator. The toSortStatement, toSelectStatement, and toGroupByStatement methods accept user-controlled object keys from API request bodies and interpolate them as ClickHouse Identifier parameters without verifying they correspond to actual model columns. ClickHouse Identifier parameters are substituted directly into queries without escaping, so an attacker who can reach any analytics list or aggregate endpoint can inject arbitrary SQL through crafted sort, select, or groupBy keys. Details Root cause StatementGenerator.ts has four methods that iterate over user-provided object keys to build SQL: | Method | Validates keys? | |--------|----------------| | toWhereStatement (line 292) | Yes - calls this.model.getTableColumn(key) | | toSortStatement (line…
Recommended action: Upgrade to 10.0.34 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. Details Vulnerable code — App/FeatureSet/Identity/API/Authentication.ts lines 370-371: The tokenVerifyUrl is a complete URL like https://app.oneuptime.com/accounts/reset-password/<plaintext-token. This is logged at INFO level, which is enabled by default in production and persisted to stdout, log files, and any configured log aggregation systems. Additionally — login credentials logged at DEBUG level (line 909): The entire login request body (including cleartext password) is logged at DEBUG level. While DEBUG is typically disabled in production, it is commonly enabled during incident troubleshooting. No existing CVEs cover sensitive data exposure in logging…
Recommended action: Upgrade to 10.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in Mermaid diagrams, enabling XSS through Mermaid's click directive which can execute arbitrary JavaScript. Any field that renders markdown (incident descriptions, status page announcements, monitor notes) is vulnerable. Details Mermaid configuration — Common/UI/Components/Markdown.tsx/MarkdownViewer.tsx:76: The Mermaid documentation explicitly warns: securityLevel: "loose" allows click events and other interactive bindings in diagrams. The safe default is "strict" which strips all interactivity. SVG injection via innerHTML — MarkdownViewer.tsx:106: After Mermaid renders the diagram to SVG, the SVG string is injected directly into the DOM via innerHTML. Combined with securityLevel: "loose", this allows event handlers embedded in the SVG to execute. Mermaid XSS payload: mermaid graph TD…
Recommended action: Upgrade to 10.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and no input validation. An authenticated user can inject arbitrary SQL into ClickHouse, enabling full database read (including telemetry data from all tenants), data modification, and potential remote code execution via ClickHouse table functions. Details Entry Point — Common/Server/API/BaseAnalyticsAPI.ts:88-98, 292-296: The POST /{modelName}/aggregate route deserializes aggregateBy directly from the request body: No schema validation is applied to aggregateBy. The object flows directly to the database service. No Validation — Common/Server/Services/AnalyticsDatabaseService.ts:276-278: The aggregationType field is only checked for existence, never validated against an…
Recommended action: Upgrade to 10.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.