PT-2023-8916 · Grafana+1 · Grafana Google Sheets Data Source Plugin+1

CVE-2023-4457 · Publicado 2023-10-16 · Atualizado 2024-04-05

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana Google Sheets data source plugin versions 0.9.0 through 1.2.1

Description The Google Sheets data source plugin for Grafana is vulnerable to an information disclosure issue due to improper sanitization of error messages. This could potentially expose the Google Sheet API-key configured for the data source.

Recommendations For versions 0.9.0 through 1.2.1, update to version 1.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the Google Sheets data source plugin until the update is applied.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

BDU:2024-02600

CVE-2023-4457

GHSA-37X5-QPM8-53RQ

GO-2023-2158

Produtos afetados

Grafana Google Sheets Data Source Plugin

Red Os

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4457.json · Exploit
• https://github.com/grafana/google-sheets-datasource · Nota
• https://bdu.fstec.ru/vul/2024-02600 · Nota de Segurança
• https://osv.dev/vulnerability/GO-2023-2158 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-37x5-qpm8-53rq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-4457 · Aviso do Fabricante
• https://grafana.com/security/security-advisories/cve-2023-4457 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-4457 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-03-04-24 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2023-4457-cve-2022-23498-cve-2023-0594 · Nota