FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-04-19 20:48:44 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
4b478274-47a0-11ec-bd24-6c3be5272acdGrafana -- XSS

Grafana Labs reports:

If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.

The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.

There are two ways an unauthenticated user can open a page in Grafana that contains the login button:

  • Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.
  • The link is to an unauthenticated page. The following pages are vulnerable:
    • /dashboard-solo/snapshot/*
    • /dashboard/snapshot/*
    • /invite/:code

The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }}

An example of an expression would be: {{constructor.constructor(‘alert(1)’)()}}. This can be included in the link URL like this:

https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1

When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.


Discovery 2021-10-21
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.3

CVE-2021-41174
https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/
757ee63b-269a-11ec-a616-6c3be5272acdGrafana -- Snapshot authentication bypass

Grafana Labs reports:

Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:

  • /dashboard/snapshot/:key, or
  • /api/snapshots/:key

If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:

  • /api/snapshots-delete/:deleteKey

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:

  • /api/snapshots/:key, or
  • /api/snapshots-delete/:deleteKey

The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.


Discovery 2021-09-15
Entry 2021-10-06
grafana8
grafana7
grafana6
grafana
ge 8.0.0 lt 8.1.6

ge 2.0.1 lt 7.5.11

CVE-2021-39226
https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/
99bff2bd-4852-11ec-a828-6c3be5272acdGrafana -- Incorrect Access Control

Grafana Labs reports:

When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.


Discovery 2021-11-02
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.4

CVE-2021-41244
https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/
a994ff7d-5b3f-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files


Discovery 2021-12-09
Entry 2021-12-12
grafana
ge 5.0.0 lt 7.5.12

ge 8.0.0 lt 8.3.2

grafana6
ge 6.0.0

grafana7
ge 7.0.0 lt 7.5.12

grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43813
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
c2a7de31-5b42-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/ds/query


Discovery 2021-12-09
Entry 2021-12-12
grafana
grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43815
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
e33880ed-5802-11ec-8398-6c3be5272acdGrafana -- Path Traversal

Grafana Labs reports:

Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /public/plugins/<“plugin-id”> where <“plugin-id”> is the plugin ID for any installed plugin.

Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:

  • /public/plugins/alertlist/
  • /public/plugins/annolist/
  • /public/plugins/barchart/
  • /public/plugins/bargauge/
  • /public/plugins/candlestick/
  • /public/plugins/cloudwatch/
  • /public/plugins/dashlist/
  • /public/plugins/elasticsearch/
  • /public/plugins/gauge/
  • /public/plugins/geomap/
  • /public/plugins/gettingstarted/
  • /public/plugins/grafana-azure-monitor-datasource/
  • /public/plugins/graph/
  • /public/plugins/heatmap/
  • /public/plugins/histogram/
  • /public/plugins/influxdb/
  • /public/plugins/jaeger/
  • /public/plugins/logs/
  • /public/plugins/loki/
  • /public/plugins/mssql/
  • /public/plugins/mysql/
  • /public/plugins/news/
  • /public/plugins/nodeGraph/
  • /public/plugins/opentsdb
  • /public/plugins/piechart/
  • /public/plugins/pluginlist/
  • /public/plugins/postgres/
  • /public/plugins/prometheus/
  • /public/plugins/stackdriver/
  • /public/plugins/stat/
  • /public/plugins/state-timeline/
  • /public/plugins/status-history/
  • /public/plugins/table/
  • /public/plugins/table-old/
  • /public/plugins/tempo/
  • /public/plugins/testdata/
  • /public/plugins/text/
  • /public/plugins/timeseries/
  • /public/plugins/welcome/
  • /public/plugins/zipkin/

Discovery 2021-12-03
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.0.7

ge 8.1.0 lt 8.1.8

ge 8.2.0 lt 8.2.7

ge 8.3.0 lt 8.3.1

CVE-2021-43798
https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/