PT-2023-8916 · Grafana+1 · Grafana Google Sheets Data Source Plugin+1

Published 2023-10-16 · Updated 2024-04-03 · CVE-2023-4457

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana Google Sheets data source plugin versions 0.9.0 through 1.2.1

Description The Google Sheets data source plugin for Grafana is vulnerable to an information disclosure issue due to improper sanitization of error messages. This could potentially expose the Google Sheet API-key configured for the data source.

Recommendations For versions 0.9.0 through 1.2.1, update to version 1.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the Google Sheets data source plugin until the update is applied.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2024-02600

CVE-2023-4457

GHSA-37X5-QPM8-53RQ

GO-2023-2158

Affected Products

Grafana Google Sheets Data Source Plugin

Red Os

References · 10

• https://bdu.fstec.ru/vul/2024-02600 · Security Note
• https://osv.dev/vulnerability/GHSA-37x5-qpm8-53rq · Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2023-4457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4457 · Security Note
• https://osv.dev/vulnerability/GO-2023-2158 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4457 · Vendor Advisory
• https://github.com/grafana/google-sheets-datasource · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2023-4457-cve-2022-23498-cve-2023-0594 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-03-04-24 · Note