CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24303 – grafana: XSS via a query alias for the Elasticsearch and Testdata datasource
https://notcve.org/view.php?id=CVE-2020-24303
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. Grafana versiones anteriores a 7.1.0-beta 1, permite un ataque de tipo XSS por medio de un alias de consulta de la fuente de datos de ElasticSearch A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed. • https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01 https://github.com/grafana/grafana/pull/25401 https://security.netapp.com/advisory/ntap-20201123-0002 https://access.redhat.com/security/cve/CVE-2020-24303 https://bugzilla.redhat.com/show_bug.cgi?id=1892418 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19499 – grafana: arbitrary file read via MySQL data source
https://notcve.org/view.php?id=CVE-2019-19499
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations. Grafana versiones anteriores a 6.4.3 incluyéndola, presenta una vulnerabilidad de Lectura Arbitraria de Archivos, que podría ser explotada por un atacante autenticado que tiene privilegios para modificar las configuraciones de la fuente de datos Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations. • https://security.netapp.com/advisory/ntap-20200918-0003 https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read https://access.redhat.com/security/cve/CVE-2019-19499 https://bugzilla.redhat.com/show_bug.cgi?id=1873615 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11110 – grafana: stored XSS
https://notcve.org/view.php?id=CVE-2020-11110
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. Grafana hasta la versión 6.7.1 permite un ataque de tipo XSS almacenado debido a la insuficiente protección de entrada en el campo originalUrl, lo que permite a un atacante inyectar código JavaScript que se ejecutará después de hacer clic en Open Original Dashboard después de visitar la instantánea A flaw was found in grafana. The lack of URL sanitizing allows for stored XSS. • https://github.com/AVE-Stoik/CVE-2020-11110-Proof-of-Concept https://github.com/grafana/grafana/blob/master/CHANGELOG.md https://security.netapp.com/advisory/ntap-20200810-0002 https://access.redhat.com/security/cve/CVE-2020-11110 https://bugzilla.redhat.com/show_bug.cgi?id=1861044 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 69%CPEs: 7EXPL: 4CVE-2020-13379 – Grafana 7.0.1 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2020-13379
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. La funcionalidad avatar en Grafana versiones 3.0.1 hasta 7.0.1, presenta un problema de Control de Acceso Incorrecto de tipo SSRF. • https://www.exploit-db.com/exploits/48638 http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.html http://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.html http://www.openwall.com/lists/oss-security/2020/06/03/4 http://www. • CWE-476: NULL Pointer Dereference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13430 – grafana: XSS via the OpenTSDB datasource
https://notcve.org/view.php?id=CVE-2020-13430
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. Grafana versiones anteriores a 7.0.0, permite un ataque de tipo XSS del valor de etiqueta por medio de la fuente de datos OpenTSDB. A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity. • https://github.com/grafana/grafana/pull/24539 https://github.com/grafana/grafana/releases/tag/v7.0.0 https://security.netapp.com/advisory/ntap-20200528-0003 https://access.redhat.com/security/cve/CVE-2020-13430 https://bugzilla.redhat.com/show_bug.cgi?id=1848108 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •