Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2024-02618

Опубликовано: 13 окт. 2022
Источник: fstec
CVSS3: 4.3
CVSS2: 4
EPSS Низкий

Описание

Уязвимость платформы для мониторинга и наблюдения Grafana связана с регистрацией чужого адреса электронной почты в качестве имени пользователя. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, блокировать попытки входа в систему

Вендор

ООО «Ред Софт»
Grafana

Наименование ПО

РЕД ОС
Grafana

Версия ПО

7.3 (РЕД ОС)
от 9.0.0 до 9.1.8 (Grafana)
до 8.5.14 (Grafana)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 4,3)

Возможные меры по устранению уязвимости

Для Grafana:
https://github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35
https://github.com/grafana/grafana/releases/tag/v9.1.8
https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 7%
0.00031
Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Связанные уязвимости

CVSS3: 4.3
ubuntu
больше 2 лет назад

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

CVSS3: 4.3
redhat
больше 2 лет назад

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

CVSS3: 4.3
nvd
больше 2 лет назад

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

CVSS3: 4.3
debian
больше 2 лет назад

Grafana is an open source data visualization platform for metrics, log ...

CVSS3: 4.3
github
около 1 года назад

Grafana when using email as a username can block other users from signing in

EPSS

Процентиль: 7%
0.00031
Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2