Описание
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Отчет
OpenShift Container Platform secures all usages of Grafana behind the oauth-proxy, preventing access to Grafana without authentication. Red Hat Product Security have rated this vulnerability as Low for OpenShift Container Platform. This issue affects the version of Grafana as shipped with Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3, as it contains the vulnerable snapshot functionality.
Меры по смягчению последствий
Block access to the snapshot feature by blocking the /api/snapshots URL via a web application firewall, load balancer, reverse proxy etc. You can also set 'external_enabled' to false to disable external snapshot publish endpoint (default true). Note, it will completely disable this feature.
cat /etc/grafana/grafana.ini
[...] [snapshots]
snapshot sharing options
external_enabled = false external_snapshot_url = https://snapshots-origin.raintank.io external_snapshot_name = Publish to snapshot.raintank.io [...]
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | grafana | Out of support scope | ||
| Red Hat Ceph Storage 3 | grafana | Affected | ||
| Red Hat OpenShift Container Platform 3.11 | openshift3/grafana | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Affected | ||
| Red Hat Storage 3 | grafana | Affected | ||
| Red Hat Enterprise Linux 8 | grafana | Fixed | RHSA-2020:1659 | 28.04.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow u ...
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
ELSA-2020-1659: grafana security, bug fix, and enhancement update (MODERATE)
EPSS
4.3 Medium
CVSS3