Security is of the utmost importance to LabKey. We take a proactive approach to improving the platform and creating secure software, testing new and existing features for potential vulnerabilities. We also acknowledge that security issues will be identified after the software has been developed and deployed. As such, we have instituted the following policies.

Reporting Security Issues

We welcome reports of any issues that the community may identify. Please use our Contact Us form to securely send us information about potential vulnerabilities.

Assessment and Remediation

Whether we discover an issue ourselves or it is reported to us, the LabKey team will promptly assess the issue, confirm if it is a true vulnerability, and determine a timeline for resolution based on the severity of the risk. We use the Common Vulnerability Scoring System (CVSS) to score the issue and guide our follow-up steps, completing the Base Score Metrics assessment under the following assumptions:

  • The LabKey Server installation is on the public Internet
  • Guest users can view at least Home project
  • Self-registration is enabled, and logged in users are at least Submitters in one folder
  • The server is configured and maintained following industry best practices

If the vulnerability is in code that is solely deployed in mitigating conditions (for example, in a module that is only used by one production installation which is behind a firewall and not on the public Internet), we will adjust the scoring accordingly.

We then compare the CVSS (version 3.1) score to the following industry ranges, and take the following actions:

None, Low0.0 - 3.9Fix in the next major LabKey Server release.
Medium4.0 - 6.9Hotfix the current LabKey Server major release, post for customers, and communicate that it contains a security fix.
High, Critical7.0 - 10.0Hotfix the current major release, backport to versions used by active customers, repost Community Edition installers, broadly communicate that there is an important security fix.

Depending on the specific circumstances, we may take a more aggressive approach than what is described here.

LabKey Server CVEs

LabKey has patched the following Common Vulnerabilities and Exposures (CVE). We thank Tenable and Rhino Security Labs for their issue reports.

CVEVulnerability TypeVersions Patched
CVE-2019-3911Reflected cross-site scripting (XSS)18.2-60915, All official 18.3 and later releases
CVE-2019-3912Open redirectsAll official 18.3 and later releases
CVE-2019-3913Site admins can unmount drive through invalid inputAll official 18.3 and later releases
CVE-2019-9758Stored cross-site scripting (XSS)19.1.1, all later releases, backported to 17.2, 18.2, and 18.3 releases
CVE-2019-9926Cross-site request forgery (CSRF) for R script reports19.1.1, all later releases, backported to 17.2, 18.2, and 18.3 releases
CVE-2019-9757XML External Entity (XXE) in PDF and SVG generation19.1.1, all later releases, backported to 17.2, 18.2, and 18.3 releases

Related Topics


Was this content helpful?

Log in or register an account to provide feedback

expand all collapse all