ALT-PU-2023-1132-2

BDU:2023-01071

HIGH7.1

Уязвимость веб-инструмента представления данных Grafana, связанная с отсутствием защиты служебных данных, позволяющая нарушителю получить доступ к сеансу текущего пользователя

Опубликовано: 2023-03-06Изменено: 2024-04-05

CVSS 3.xВЫСОКАЯ 7.1

CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

CVSS 2.0СРЕДНЯЯ 6.8

CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:P

Ссылки

CVE-2022-23498

BDU:2023-01731

MEDIUM6.4

Уязвимость веб-инструмента представления данных Grafana, связанная с недостаточной очисткой пользовательских данныхt, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)

Опубликовано: 2023-03-29Изменено: 2024-04-05

CVSS 3.xСРЕДНЯЯ 6.4

CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CVSS 2.0СРЕДНЯЯ 6.6

CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:N

Ссылки

CVE-2023-22462

BDU:2024-02615

MEDIUM5.4

Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с неправильной нейтрализацией ввода во время создания веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)

Опубликовано: 2024-04-05

CVSS 3.xСРЕДНЯЯ 5.4

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0СРЕДНЯЯ 5.5

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:N

Ссылки

CVE-2022-23552

CVE-2022-23498

HIGH8.8

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.

Опубликовано: 2023-02-03Изменено: 2024-11-21

CVSS 3.xВЫСОКАЯ 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ссылки

CVE-2022-23552

MEDIUM5.4

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.

Опубликовано: 2023-01-27Изменено: 2024-11-21

CVSS 3.xСРЕДНЯЯ 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Ссылки

CVE-2023-22462

MEDIUM5.4

Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.

Опубликовано: 2023-03-02Изменено: 2024-11-21

CVSS 3.xСРЕДНЯЯ 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Ссылки

GHSA-7rqg-hjwc-6mjf

MEDIUM6.4

Grafana vulnerable to Stored Cross-site Scripting in Text plugin

Опубликовано: 2023-03-01Изменено: 2023-03-02

CVSS 3.xСРЕДНЯЯ 6.4

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Ссылки

Обновление пакета grafana в ветке sisyphus

Закрытые проблемы (7)

Grafana vulnerable to Stored Cross-site Scripting in Text plugin