CVE-2019-3911

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-01-30 · updated 2026-06-17
Weakness: CWE-79

Description

Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.

Affected products

Tenable LabKey Server Community Edition: before 18.3.0-61806.763 — fixed in 18.3.0-61806.763

How to fix

Upgrade to a fixed version: Tenable LabKey Server Community Edition 18.3.0-61806.763. Check the vendor advisory for mitigations.

References

https://www.tenable.com/security/research/tra-2019-03
https://www.tenable.com/security/research/tra-2019-03

Get alerted when CVE-2019-3911 or the next vulnerability affects your stack