Skip to main content

Clickhouse CVE-2019-18657

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2019-10-31 cve@mitre.org
Code Injection Clickhouse
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 31, 2019 - 19:15 nvd
MEDIUM 5.3

DescriptionNVD

ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.

AnalysisAI

ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-74. ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. Affected products include: Clickhouse. Version information: before 19.13.5.44.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Clickhouse

View all
CVE-2024-23689 HIGH POC
8.8 Jan 19

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and co
CVE-2024-41436 HIGH POC
7.5 Sep 03

ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
CVE-2023-47118 CRITICAL
9.8 Dec 20

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports

CVE-2019-16535 CRITICAL
9.8 Dec 30

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can
CVE-2024-22412 MEDIUM POC
4.9 Mar 18

ClickHouse is an open-source column-oriented database management system. Rated medium severity (CVSS 4.9), this vulnerab
CVE-2019-16536 HIGH
8.2 May 21

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. Rated
CVE-2023-48704 HIGH
7.5 Dec 22

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports i
CVE-2023-48298 HIGH
7.5 Dec 21

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports

CVE-2019-15024 MEDIUM
6.5 Dec 30

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a cust
CVE-2025-1386 MEDIUM
5.9 Apr 11

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious externa

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2019-18657 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy