PT-2018-9540 · Influxdata+3 · Influxdb+3

Published 2018-12-13 · Updated 2022-05-14 · CVE-2018-1000816

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grafana versions 5.2.4 and 5.3.0

Description The issue concerns a Cross Site Scripting (XSS) vulnerability in the Influxdb and Graphite query editor. This vulnerability can lead to the execution of arbitrary JavaScript code in the victim's browser. The attack is exploitable when an authenticated user clicks on the input field where the malicious payload was previously inserted.

Recommendations For Grafana version 5.2.4, update to a version that contains a fix for this issue. For Grafana version 5.3.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Influxdb and Graphite query editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2018-2838

CVE-2018-1000816

ECHO-E419-828F-5730

GHSA-X5FH-FVVR-892F

Affected Products

Alt Linux

Grafana

Graphite

Influxdb

References · 10

• 🔥 https://github.com/grafana/grafana/issues/13667 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000816 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000816 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x5fh-fvvr-892f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1000816 · Security Note
• https://github.com/grafana/grafana · Note
• https://github.com/grafana/grafana/pull/13670 · Note
• https://github.com/grafana/grafana/commit/eabb04cec21dc323347da1aab7fcbf2a6e9dd121 · Note