PT-2019-11152 · Coreos+1 · Coreos Tectonic+1

Publicado 2019-09-24 · Atualizado 2019-09-24 · CVE-2018-9090

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: CoreOS Tectonic versions 1.7.x through 1.8.6

Description: The issue arises because CoreOS Tectonic deploys the Grafana web application with default credentials, specifically admin/admin, for the administrator account. This default credential setup is located in the grafana-credentials secret. Since CoreOS does not randomize the administrative password, it remains unchanged until configured by Tectonic administrators. An attacker can exploit this by inserting an XSS payload into the dashboards.

Recommendations: For CoreOS Tectonic versions 1.7.x through 1.8.6, update to version 1.8.7-tectonic.2 or later to resolve the issue. As a temporary workaround, consider changing the default administrator credentials admin/admin to a secure password to minimize the risk of exploitation. Restrict access to the Grafana web application until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-9090

Produtos afetados

Coreos Tectonic

Grafana

Referências · 4

• https://coreos.com/tectonic/releases · Aviso do Fabricante
• https://coreos.com/tectonic/releases/#1.8.7-tectonic.2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9090 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-9090 · Aviso do Fabricante