FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
0859e6d5-0415-11ed-a53b-6c3be5272acdGrafana -- OAuth Account Takeover

Grafana Labs reports:

It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.


Discovery 2022-06-27
Entry 2022-07-15
grafana
ge 5.3.0 lt 8.3.10

ge 8.4.0 lt 8.4.10

ge 8.5.0 lt 8.5.9

ge 9.0.0 lt 9.0.3

grafana7
ge 7.0

grafana8
ge 8.3.0 lt 8.3.10

ge 8.4.0 lt 8.4.10

ge 8.5.0 lt 8.5.9

grafana9
< 9.0.3

CVE-2022-31107
https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2
0a80f159-629b-11ed-9ca2-6c3be5272acdGrafana -- Username enumeration

Grafana Labs reports:

When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message.

The CVSS score for this vulnerability is 5.3 Moderate


Discovery 2022-10-24
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.15

ge 9.0.0 lt 9.2.4

grafana8
ge 8.0.0 lt 8.5.15

grafana9
ge 9.0.0 lt 9.2.4

CVE-2022-39307
https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
0c367e98-0415-11ed-a53b-6c3be5272acdGrafana -- Stored XSS

Grafana Labs reports:

An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. (Note: Grafana Alerting is activated by default in Grafana 9.0.)


Discovery 2022-06-19
Entry 2022-07-15
grafana
ge 8.3.0 lt 8.3.10

ge 8.4.0 lt 8.4.10

ge 8.5.0 lt 8.5.9

ge 9.0.0 lt 9.0.3

ge 9.1.0 lt 9.2.7

grafana8
ge 8.3.0 lt 8.3.10

ge 8.4.0 lt 8.4.10

ge 8.5.0 lt 8.5.9

grafana9
< 9.0.3

ge 9.1.0 lt 9.2.7

CVE-2022-31097
https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f
4b478274-47a0-11ec-bd24-6c3be5272acdGrafana -- XSS

Grafana Labs reports:

If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.

The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.

There are two ways an unauthenticated user can open a page in Grafana that contains the login button:

  • Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.
  • The link is to an unauthenticated page. The following pages are vulnerable:
    • /dashboard-solo/snapshot/*
    • /dashboard/snapshot/*
    • /invite/:code

The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }}

An example of an expression would be: {{constructor.constructor(‘alert(1)’)()}}. This can be included in the link URL like this:

https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1

When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.


Discovery 2021-10-21
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.3

CVE-2021-41174
https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/
4e60d660-6298-11ed-9ca2-6c3be5272acdGrafana -- Plugin signature bypass

Grafana Labs reports:

On July 4th as a result of an internal security audit we have discovered a bypass in the plugin signature verification by exploiting a versioning flaw.

We believe that this vulnerability is rated at CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).


Discovery 2022-07-04
Entry 2022-11-12
grafana
ge 7.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-31123
https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8
6877e164-6296-11ed-9ca2-6c3be5272acdGrafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports:

On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions.

We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)


Discovery 2022-09-07
Entry 2022-11-12
grafana
ge 5.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-39201
https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr
6eb6a442-629a-11ed-9ca2-6c3be5272acdGrafana -- Privilege escalation

Grafana Labs reports:

Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization.

The CVSS score for this vulnerability is 6.4 Moderate


Discovery 2022-10-24
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.15

ge 9.0.0 lt 9.2.4

grafana8
ge 8.0.0 lt 8.5.15

grafana9
ge 9.0.0 lt 9.2.4

CVE-2022-39306
https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84
6f6c9420-6297-11ed-9ca2-6c3be5272acdGrafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports:

On June 26 a security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis the vulnerability impacts data source and plugin proxy endpoints with authentication tokens but under some conditions.

We believe that this vulnerability is rated at CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)


Discovery 2022-06-26
Entry 2022-11-12
grafana
ge 7.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana7
ge 7.0.0

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-31130
https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc
757ee63b-269a-11ec-a616-6c3be5272acdGrafana -- Snapshot authentication bypass

Grafana Labs reports:

Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:

  • /dashboard/snapshot/:key, or
  • /api/snapshots/:key

If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:

  • /api/snapshots-delete/:deleteKey

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:

  • /api/snapshots/:key, or
  • /api/snapshots-delete/:deleteKey

The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.


Discovery 2021-09-15
Entry 2021-10-06
grafana8
grafana7
grafana6
grafana
ge 8.0.0 lt 8.1.6

ge 2.0.1 lt 7.5.11

CVE-2021-39226
https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/
827b95ff-290e-11ed-a2e7-6c3be5272acdGrafana -- Unauthorized file disclosure

Grafana Labs reports:

On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the Grafana Image Renderer plugin when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files in a PNG file. This makes it possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake data source (this applies if the user has admin permissions in Grafana).


Discovery 2022-07-21
Entry 2022-09-01
grafana
ge 5.2.0 lt 8.3.11

ge 8.4.0 lt 8.4.11

ge 8.5.0 lt 8.5.11

ge 9.0.0 lt 9.0.8

ge 9.1.0 lt 9.1.2

grafana7
ge 7.0

grafana8
ge 8.3.0 lt 8.3.11

ge 8.4.0 lt 8.4.11

ge 8.5.0 lt 8.5.11

grafana9
ge 9.0.0 lt 9.0.8

ge 9.1.0 lt 9.1.2

CVE-2022-31176
https://github.com/grafana/grafana-image-renderer/security/advisories/GHSA-2cfh-233g-m4c5
909a80ba-6294-11ed-9ca2-6c3be5272acdGrafana -- Improper authentication

Grafana Labs reports:

On September 7, as a result of an internal security audit, we discovered a security vulnerability in Grafana’s basic authentication related to the usage of username and email address.

n Grafana, a user’s username and email address are unique fields, which means no other user can have the same username or email address as another user.

In addition, a user can have an email address as a username, and the Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where user_1 can register with one email address and user_2 can register their username as user_1’s email address. As a result, user_1 would be prevented from signing in to Grafana, since user_1 password won’t match with user_2 email address.

The CVSS score for this vulnerability is 4.3 moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).


Discovery 2022-09-07
Entry 2022-11-12
grafana
ge 8.0.0 lt 8.5.14

ge 9.0.0 lt 9.1.8

grafana8
ge 8.0.0 lt 8.5.14

grafana9
ge 9.0.0 lt 9.1.8

CVE-2022-39229
https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r
95e6e6ca-3986-11ed-8e0c-6c3be5272acdGrafana -- Privilege escalation

Grafana Labs reports:

On August 9 an internal security review identified a vulnerability in the Grafana which allows an escalation from Admin privileges to Server Admin when Auth proxy authentication is used.

Auth proxy allows to authenticate a user by only providing the username (or email) in a X-WEBAUTH-USER HTTP header: the trust assumption is that a front proxy will take care of authentication and that Grafana server is publicly reachable only with this front proxy.

Datasource proxy breaks this assumption:

  • it is possible to configure a fake datasource pointing to a localhost Grafana install with a X-WEBAUTH-USER HTTP header containing admin username.
  • This fake datasource can be called publicly via this proxying feature.

The CVSS score for this vulnerability is 6.6 Moderate (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).


Discovery 2022-08-09
Entry 2022-09-21
grafana
ge 2.1.0 lt 8.5.13

ge 9.0.0 lt 9.0.9

ge 9.1.0 lt 9.1.6

grafana7
ge 7.0

grafana8
ge 8.0.0 lt 8.5.13

grafana9
ge 9.0.0 lt 9.0.9

ge 9.1.0 lt 9.1.6

CVE-2022-35957
https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
99bff2bd-4852-11ec-a828-6c3be5272acdGrafana -- Incorrect Access Control

Grafana Labs reports:

When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.


Discovery 2021-11-02
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.4

CVE-2021-41244
https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/
a994ff7d-5b3f-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files


Discovery 2021-12-09
Entry 2021-12-12
grafana
ge 5.0.0 lt 7.5.12

ge 8.0.0 lt 8.3.2

grafana6
ge 6.0.0

grafana7
ge 7.0.0 lt 7.5.12

grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43813
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
c2a7de31-5b42-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/ds/query


Discovery 2021-12-09
Entry 2021-12-12
grafana
grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43815
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
db895ed0-6298-11ed-9ca2-6c3be5272acdGrafana -- Privilege escalation

Grafana Labs reports:

Internal security audit identified a race condition in the Grafana codebase, which allowed an unauthenticated user to query an arbitrary endpoint in Grafana. A race condition in the HTTP context creation could make a HTTP request being assigned the authentication/authorization middlewares of another call. Under heavy load it is possible that a call protected by a privileged middleware receives instead the middleware of a public query. As a result, an unauthenticated user can successfully query protected endpoints.

The CVSS score for this vulnerability is 9.8 Critical


Discovery 2022-11-08
Entry 2022-11-12
grafana
ge 9.2.0 lt 9.2.4

grafana9
ge 9.2.0 lt 9.2.4

CVE-2022-39328
https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch
e33880ed-5802-11ec-8398-6c3be5272acdGrafana -- Path Traversal

Grafana Labs reports:

Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /public/plugins/<“plugin-id”> where <“plugin-id”> is the plugin ID for any installed plugin.

Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:

  • /public/plugins/alertlist/
  • /public/plugins/annolist/
  • /public/plugins/barchart/
  • /public/plugins/bargauge/
  • /public/plugins/candlestick/
  • /public/plugins/cloudwatch/
  • /public/plugins/dashlist/
  • /public/plugins/elasticsearch/
  • /public/plugins/gauge/
  • /public/plugins/geomap/
  • /public/plugins/gettingstarted/
  • /public/plugins/grafana-azure-monitor-datasource/
  • /public/plugins/graph/
  • /public/plugins/heatmap/
  • /public/plugins/histogram/
  • /public/plugins/influxdb/
  • /public/plugins/jaeger/
  • /public/plugins/logs/
  • /public/plugins/loki/
  • /public/plugins/mssql/
  • /public/plugins/mysql/
  • /public/plugins/news/
  • /public/plugins/nodeGraph/
  • /public/plugins/opentsdb
  • /public/plugins/piechart/
  • /public/plugins/pluginlist/
  • /public/plugins/postgres/
  • /public/plugins/prometheus/
  • /public/plugins/stackdriver/
  • /public/plugins/stat/
  • /public/plugins/state-timeline/
  • /public/plugins/status-history/
  • /public/plugins/table/
  • /public/plugins/table-old/
  • /public/plugins/tempo/
  • /public/plugins/testdata/
  • /public/plugins/text/
  • /public/plugins/timeseries/
  • /public/plugins/welcome/
  • /public/plugins/zipkin/

Discovery 2021-12-03
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.0.7

ge 8.1.0 lt 8.1.8

ge 8.2.0 lt 8.2.7

ge 8.3.0 lt 8.3.1

CVE-2021-43798
https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/