Red Hat Security AdvisoryRHSA-2020:4682
grafana security, bug fix, and enhancement update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) grafana-6.7.4-3.el8, grafana-azure-monitor-6.7.4-3.el8, grafana-cloudwatch-6.7.4-3.el8 +10
Fixes 8 records
Priority LOW 36
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard af…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.09619 · Published 2020-07-27 · Partial fix · 6.7.2 CWE-79
Priority LOW 35
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.03523 · Published 2020-08-28 · Partial fix · 6.4.4 CWE-89
Priority LOW 31
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01873 · Published 2020-05-24 · Partial fix · 7.0.0 CWE-79
Priority LOW 31
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01962 · Published 2020-04-24 · Partial fix · 6.7.3 CWE-79
Priority LOW 30
Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0148 · Published 2020-04-27 · Partial fix CWE-79
Priority LOW 30
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01405 · Published 2020-06-02 · Partial fix · 7.0.0 CWE-79
Priority LOW 25
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0032 · Published 2020-04-29 · Partial fix · 7.2.1 CWE-732
Priority LOW 25
An information-disclosure flaw was found in Grafana through 6.7.3.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00488 · Published 2020-04-29 · Partial fix · 7.2.1 CWE-732
THREATIST.IORead the docs