Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1859 advisory.

  - Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
    (CVE-2020-24303)

  - A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML     Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as     system availability. (CVE-2020-27846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has grafana packages installed that are affected by multiple vulnerabilities:

  - Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
    (CVE-2020-24303)

  - A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML     Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as     system availability. (CVE-2020-27846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-1859 advisory.

    [7.3.6-2]
    - change working dir to  in grafana-cli wrapper (fixes Red Hat BZ #1916083)
    - add pcp-redis-datasource to allow_loading_unsigned_plugins config option

    [7.3.6-1]
    - update to 7.3.6 tagged upstream community sources, see CHANGELOG
    - remove dependency on SAML (not supported in the open source version of Grafana)

    [7.3.4-1]
    - update to 7.3.4 tagged upstream community sources, see CHANGELOG
    - bundle golang dependencies
    - optionally bundle node.js dependencies and build and test frontend as part of the specfile
    - merge all datasources into main grafana package
    - change default provisioning path to /etc/grafana/provisioning
    - resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1859 advisory.

  - grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

  - crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1859 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    The following packages have been upgraded to a later upstream version: grafana (7.3.6). (BZ#1850471)

    Security Fix(es):

    * crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

    * grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184816	Rocky Linux 8 : grafana (RLSA-2021:1859)	Nessus	Rocky Linux Local Security Checks	critical
160861	NewStart CGSL MAIN 6.02 : grafana Multiple Vulnerabilities (NS-SA-2022-0053)	Nessus	NewStart CGSL Local Security Checks	critical
149918	Oracle Linux 8 : grafana (ELSA-2021-1859)	Nessus	Oracle Linux Local Security Checks	critical
149734	CentOS 8 : grafana (CESA-2021:1859)	Nessus	CentOS Local Security Checks	critical
149689	RHEL 8 : grafana (RHSA-2021:1859)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-24303

medium

Tenable Plugins

critical

critical

critical

critical

critical