FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
e33880ed-5802-11ec-8398-6c3be5272acdGrafana -- Path Traversal

Grafana Labs reports:

Grafana is vulnerable to directory traversal, allowing access to local files. We have confirmed this for versions v8.0.0-beta1 to v8.3.0. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /public/plugins/<“plugin-id”> where <“plugin-id”> is the plugin ID for any installed plugin.

Every Grafana instance comes with pre-installed plugins like the Prometheus plugin or MySQL plugin so the following URLs are vulnerable for every instance:

  • /public/plugins/alertlist/
  • /public/plugins/annolist/
  • /public/plugins/barchart/
  • /public/plugins/bargauge/
  • /public/plugins/candlestick/
  • /public/plugins/cloudwatch/
  • /public/plugins/dashlist/
  • /public/plugins/elasticsearch/
  • /public/plugins/gauge/
  • /public/plugins/geomap/
  • /public/plugins/gettingstarted/
  • /public/plugins/grafana-azure-monitor-datasource/
  • /public/plugins/graph/
  • /public/plugins/heatmap/
  • /public/plugins/histogram/
  • /public/plugins/influxdb/
  • /public/plugins/jaeger/
  • /public/plugins/logs/
  • /public/plugins/loki/
  • /public/plugins/mssql/
  • /public/plugins/mysql/
  • /public/plugins/news/
  • /public/plugins/nodeGraph/
  • /public/plugins/opentsdb
  • /public/plugins/piechart/
  • /public/plugins/pluginlist/
  • /public/plugins/postgres/
  • /public/plugins/prometheus/
  • /public/plugins/stackdriver/
  • /public/plugins/stat/
  • /public/plugins/state-timeline/
  • /public/plugins/status-history/
  • /public/plugins/table/
  • /public/plugins/table-old/
  • /public/plugins/tempo/
  • /public/plugins/testdata/
  • /public/plugins/text/
  • /public/plugins/timeseries/
  • /public/plugins/welcome/
  • /public/plugins/zipkin/

Discovery 2021-12-03
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.0.7

ge 8.1.0 lt 8.1.8

ge 8.2.0 lt 8.2.7

ge 8.3.0 lt 8.3.1

CVE-2021-43798
https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
d71d154a-8b83-11ec-b369-6c3be5272acdGrafana -- Teams API IDOR

Grafana Labs reports:

On Jan. 18, an external security researcher, Kürşad ALSAN from NSPECT.IO (@nspectio on Twitter), contacted Grafana to disclose an IDOR (Insecure Direct Object Reference) vulnerability on Grafana Teams APIs. This vulnerability only impacts the following API endpoints:

  • /teams/:teamId - an authenticated attacker can view unintended data by querying for the specific team ID.
  • /teams/:search - an authenticated attacker can search for teams and see the total number of available teams, including for those teams that the user does not have access to.
  • /teams/:teamId/members - when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID.

We believe that this vulnerability is rated at CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).


Discovery 2022-01-18
Entry 2022-02-12
grafana6
ge 6.0.0

grafana7
lt 7.5.15

grafana8
lt 8.3.5

CVE-2022-21713
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
c2a7de31-5b42-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/ds/query


Discovery 2021-12-09
Entry 2021-12-12
grafana
grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43815
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
d4284c2e-8b83-11ec-b369-6c3be5272acdGrafana -- CSRF

Grafana Labs reports:

On Jan. 18, security researchers @jub0bs and @abrahack contacted Grafana to disclose a CSRF vulnerability which allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).


Discovery 2022-01-18
Entry 2022-02-12
grafana6
ge 6.0.0

grafana7
lt 7.5.15

grafana8
lt 8.3.5

CVE-2022-21703
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
a994ff7d-5b3f-11ec-8398-6c3be5272acdGrafana -- Directory Traversal

GitHub Security Labs reports:

A vulnerability through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. Doing our own follow-up investigation we found a related vulnerability through which authenticated users could read out arbitrary .csv files through directory traversal. Thanks to our defense-in-depth approach, at no time has Grafana Cloud been vulnerable.

The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files


Discovery 2021-12-09
Entry 2021-12-12
grafana
ge 5.0.0 lt 7.5.12

ge 8.0.0 lt 8.3.2

grafana6
ge 6.0.0

grafana7
ge 7.0.0 lt 7.5.12

grafana8
ge 8.0.0 lt 8.3.2

CVE-2021-43813
https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/
4b478274-47a0-11ec-bd24-6c3be5272acdGrafana -- XSS

Grafana Labs reports:

If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.

The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.

There are two ways an unauthenticated user can open a page in Grafana that contains the login button:

  • Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.
  • The link is to an unauthenticated page. The following pages are vulnerable:
    • /dashboard-solo/snapshot/*
    • /dashboard/snapshot/*
    • /invite/:code

The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }}

An example of an expression would be: {{constructor.constructor(‘alert(1)’)()}}. This can be included in the link URL like this:

https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1

When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.


Discovery 2021-10-21
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.3

CVE-2021-41174
https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/
cecbc674-8b83-11ec-b369-6c3be5272acdGrafana -- XSS

Grafana Labs reports:

On Jan. 16, an external security researcher, Jasu Viding contacted Grafana to disclose an XSS vulnerability in the way that Grafana handles data sources. Should an existing data source connected to Grafana be compromised, it could be used to inappropriately gain access to other data sources connected to the same Grafana org. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).


Discovery 2022-01-16
Entry 2022-02-12
grafana6
ge 6.0.0

grafana7
lt 7.5.15

grafana8
lt 8.3.5

CVE-2022-21702
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
757ee63b-269a-11ec-a616-6c3be5272acdGrafana -- Snapshot authentication bypass

Grafana Labs reports:

Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:

  • /dashboard/snapshot/:key, or
  • /api/snapshots/:key

If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:

  • /api/snapshots-delete/:deleteKey

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:

  • /api/snapshots/:key, or
  • /api/snapshots-delete/:deleteKey

The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.


Discovery 2021-09-15
Entry 2021-10-06
grafana8
grafana7
grafana6
grafana
ge 8.0.0 lt 8.1.6

ge 2.0.1 lt 7.5.11

CVE-2021-39226
https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/
99bff2bd-4852-11ec-a828-6c3be5272acdGrafana -- Incorrect Access Control

Grafana Labs reports:

When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.


Discovery 2021-11-02
Entry 2021-12-11
grafana8
grafana
ge 8.0.0 lt 8.2.4

CVE-2021-41244
https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/