Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-01776

Опубликовано: 08 фев. 2023
Источник: fstec
CVSS3: 7.3
CVSS2: 8.5
EPSS Средний

Описание

Уязвимость панели Trace View веб-инструмента представления данных Grafana связана с недостаточной защитой структуры веб-страницы при обработке значений атрибутов и ресурсов диапазона. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, повысить свои привилегии и осуществить межсайтовые сценарные атаки

Вендор

ООО «Ред Софт»
Red Hat Inc.
Grafana

Наименование ПО

РЕД ОС
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Ceph Storage
Grafana

Версия ПО

7.3 (РЕД ОС)
2 (Red Hat Advanced Cluster Management for Kubernetes)
5 (Red Hat Ceph Storage)
от 9.3.0 до 9.3.8 (Grafana)
от 7.0.0 до 8.5.21 (Grafana)
от 9.0.0 до 9.2.13 (Grafana)

Тип ПО

Операционная система
Сетевое средство
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 8,5)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,3)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Grafana:
https://grafana.com/security/security-advisories/cve-2023-0594/
Для продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2023-0594
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 97%
0.34027
Средний

7.3 High

CVSS3

8.5 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
redos
около 1 года назад

Множественные уязвимости grafana

CVSS3: 7.3
ubuntu
больше 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

CVSS3: 7.3
redhat
больше 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

CVSS3: 7.3
nvd
больше 2 лет назад

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

CVSS3: 7.3
debian
больше 2 лет назад

Grafana is an open-source platform for monitoring and observability. ...

EPSS

Процентиль: 97%
0.34027
Средний

7.3 High

CVSS3

8.5 High

CVSS2