Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - grafana: session control failure may lead to information disclosure (CVE-2022-32275)

  - protobufjs: prototype pollution using user-controlled protobuf message (CVE-2023-36665)

  - The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to     add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by     providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by     parsing/loading .proto files (CVE-2022-25878)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - grafana: session control failure may lead to information disclosure (CVE-2022-32275)

  - protobufjs: prototype pollution using user-controlled protobuf message (CVE-2023-36665)

  - The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to     add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by     providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by     parsing/loading .proto files (CVE-2022-25878)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6dccc186-b824-11ed-b695-6c3be5272acd advisory.

  - Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal     audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin     Text. The stored XSS vulnerability requires several user interactions in order to be fully exploited.
    The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML     code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to     have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the     same Text panel, and click on Markdown or HTML for the code to be executed. This means that vertical     privilege escalation is possible, where a user with Editor role can change to a known password for a user     having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This     issue has been patched in versions 9.2.10 and 9.3.4. (CVE-2023-22462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199102	RHEL 8 : grafana (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199090	RHEL 9 : grafana (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
172084	FreeBSD : Grafana -- Stored XSS in text panel plugin (6dccc186-b824-11ed-b695-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-22462

medium

Tenable Plugins

critical

critical

medium