PT-2019-11152 · Coreos+1 · Coreos Tectonic+1

Published 2019-09-24 · Updated 2019-09-24 · CVE-2018-9090

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: CoreOS Tectonic versions 1.7.x through 1.8.6

Description: The issue arises because CoreOS Tectonic deploys the Grafana web application with default credentials, specifically admin/admin, for the administrator account. This default credential setup is located in the grafana-credentials secret. Since CoreOS does not randomize the administrative password, it remains unchanged until configured by Tectonic administrators. An attacker can exploit this by inserting an XSS payload into the dashboards.

Recommendations: For CoreOS Tectonic versions 1.7.x through 1.8.6, update to version 1.8.7-tectonic.2 or later to resolve the issue. As a temporary workaround, consider changing the default administrator credentials admin/admin to a secure password to minimize the risk of exploitation. Restrict access to the Grafana web application until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-9090

Affected Products

Coreos Tectonic

Grafana

References · 4

• https://coreos.com/tectonic/releases · Vendor Advisory
• https://coreos.com/tectonic/releases/#1.8.7-tectonic.2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9090 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9090 · Vendor Advisory