The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7519 advisory.

    - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
    - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
    - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not     working
    - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
    - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
    - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
    - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
    - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
    - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
    - resolve CVE-2022-31107 grafana: OAuth account takeover
    - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
    - resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
    - resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
    - resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
    - resolve CVE-2021-23648 sanitize-url: XSS
    - resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : grafana (ELSA-2022-7519)

high Nessus Plugin ID 167547

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.5 Oct 22, 2024, 6:42 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202410221842
Version 1.4 Oct 3, 2023, 2:18 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310031418
Version 1.3 Nov 21, 2022, 6:04 PM IAVM reference Plugin Feed: 202211211804
Version 1.2 Nov 16, 2022, 12:10 PM New Plugin Feed: 202211161210