PT-2019-7242 · Grafana · Grafana Piechart-Panel Plugin

Feroz Salamon · Publicado 2019-02-06 · Atualizado 2019-06-11 · CVE-2015-9282

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Grafana Pie Chart Panel plugin versions prior to 2019-01-02

Description The issue allows an attacker to gain remote unauthenticated access to a Grafana dashboard when a chart is included. This is possible due to XSS via legend data or tooltip data.

Recommendations For versions prior to 2019-01-02, update the Pie Chart Panel plugin to a version released after 2019-01-02 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-9282

Produtos afetados

Grafana Piechart-Panel Plugin

Referências · 5

• 🔥 https://padlock.argh.in/2019/02/05/exploiting-xss-grafana.html · Exploit
• https://github.com/grafana/grafana/issues/4117 · Nota
• https://github.com/grafana/piechart-panel/issues/3 · Nota
• https://github.com/grafana/piechart-panel/pull/163 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-9282 · Nota de Segurança