CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11110 – grafana: stored XSS
https://notcve.org/view.php?id=CVE-2020-11110
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. Grafana hasta la versión 6.7.1 permite un ataque de tipo XSS almacenado debido a la insuficiente protección de entrada en el campo originalUrl, lo que permite a un atacante inyectar código JavaScript que se ejecutará después de hacer clic en Open Original Dashboard después de visitar la instantánea A flaw was found in grafana. The lack of URL sanitizing allows for stored XSS. • https://github.com/AVE-Stoik/CVE-2020-11110-Proof-of-Concept https://github.com/grafana/grafana/blob/master/CHANGELOG.md https://security.netapp.com/advisory/ntap-20200810-0002 https://access.redhat.com/security/cve/CVE-2020-11110 https://bugzilla.redhat.com/show_bug.cgi?id=1861044 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 69%CPEs: 7EXPL: 4CVE-2020-13379 – Grafana 7.0.1 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2020-13379
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. La funcionalidad avatar en Grafana versiones 3.0.1 hasta 7.0.1, presenta un problema de Control de Acceso Incorrecto de tipo SSRF. • https://www.exploit-db.com/exploits/48638 http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.html http://www.openwall.com/lists/oss-security/2020/06/03/4 http://www. • CWE-476: NULL Pointer Dereference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13430 – grafana: XSS via the OpenTSDB datasource
https://notcve.org/view.php?id=CVE-2020-13430
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. Grafana versiones anteriores a 7.0.0, permite un ataque de tipo XSS del valor de etiqueta por medio de la fuente de datos OpenTSDB. A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity. • https://github.com/grafana/grafana/pull/24539 https://github.com/grafana/grafana/releases/tag/v7.0.0 https://security.netapp.com/advisory/ntap-20200528-0003 https://access.redhat.com/security/cve/CVE-2020-13430 https://bugzilla.redhat.com/show_bug.cgi?id=1848108 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 6EXPL: 1CVE-2020-12458 – grafana: information disclosure through world-readable /var/lib/grafana/grafana.db
https://notcve.org/view.php?id=CVE-2020-12458
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords). Se encontró un fallo de divulgación de información en Grafana versiones hasta 6.7.3. El directorio de base de datos /var/lib/grafana y el archivo de base de datos /var/lib/grafana/grafana.db son de tipo world readable. • https://access.redhat.com/security/cve/CVE-2020-12458 https://bugzilla.redhat.com/show_bug.cgi?id=1827765 https://github.com/grafana/grafana/issues/8283 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTQCKJZZYXMCSHJFZZ3YXEO5NUBANGZS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WEBCIEVSYIDDCA7FTRS2IFUOYLIQU34A https://security.netapp.com/advisory/ntap-20200518-0001 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12052 – grafana: XSS annotation popup vulnerability
https://notcve.org/view.php?id=CVE-2020-12052
Grafana version < 6.7.3 is vulnerable for annotation popup XSS. Grafana versiones anteriores a la versión 6.7.3, es vulnerable a un ataque de tipo XSS del popup de anotaciones. A flaw was found in grafana. The software is vulnerable to an annotation popup XSS. • https://community.grafana.com/t/release-notes-v6-7-x/27119 https://security.netapp.com/advisory/ntap-20200511-0001 https://access.redhat.com/security/cve/CVE-2020-12052 https://bugzilla.redhat.com/show_bug.cgi?id=1848089 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •