A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0073 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-11110:
    Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field,     which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original     Dashboard after visiting the snapshot.

    CVE-2020-12052:
    Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

    CVE-2020-12245:
    Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

    CVE-2020-24303:
    Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

    CVE-2020-27846:
    A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML     Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as     system availability.

    CVE-2019-15043:
    In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it     possible to run a denial of service attack against the server running Grafana.

    CVE-2020-12458:
    An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana     and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive     information (e.g., cleartext or encrypted datasource passwords).

    CVE-2020-12459:
    In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files     /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are     world readable.

    CVE-2020-13379:
    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This     vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and     return its result to the user/client. This can be used to gain information about the network that Grafana     is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

    CVE-2020-13430:
    Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

    CVE-2021-27358:
    The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.

    CVE-2021-39226:
    Grafana is an open source data visualization platform. In affected versions unauthenticated and     authenticated users are able to view the snapshot with the lowest database key by accessing the literal     paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot public_mode configuration     setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with     the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the     snapshot public_mode setting, authenticated users are able to delete the snapshot with the lowest     database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The     combination of deletion and viewing enables a complete walk through all snapshot data while resulting in     complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason     you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths:
    /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key.
    They have no normal function and can be disabled without side effects.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1859 advisory.

  - Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
    (CVE-2020-24303)

  - A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML     Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as     system availability. (CVE-2020-27846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has grafana packages installed that are affected by multiple vulnerabilities:

  - Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
    (CVE-2020-24303)

  - A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML     Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as     system availability. (CVE-2020-27846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-1859 advisory.

    [7.3.6-2]
    - change working dir to  in grafana-cli wrapper (fixes Red Hat BZ #1916083)
    - add pcp-redis-datasource to allow_loading_unsigned_plugins config option

    [7.3.6-1]
    - update to 7.3.6 tagged upstream community sources, see CHANGELOG
    - remove dependency on SAML (not supported in the open source version of Grafana)

    [7.3.4-1]
    - update to 7.3.4 tagged upstream community sources, see CHANGELOG
    - bundle golang dependencies
    - optionally bundle node.js dependencies and build and test frontend as part of the specfile
    - merge all datasources into main grafana package
    - change default provisioning path to /etc/grafana/provisioning
    - resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1859 advisory.

  - grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

  - crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1859 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    The following packages have been upgraded to a later upstream version: grafana (7.3.6). (BZ#1850471)

    Security Fix(es):

    * crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

    * grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

update to upstream 7.3.6

Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
236664	Alibaba Cloud Linux 3 : 0073: grafana (ALINUX3-SA-2021:0073)	Nessus	Alibaba Cloud Linux Local Security Checks	high
184816	Rocky Linux 8 : grafana (RLSA-2021:1859)	Nessus	Rocky Linux Local Security Checks	critical
160861	NewStart CGSL MAIN 6.02 : grafana Multiple Vulnerabilities (NS-SA-2022-0053)	Nessus	NewStart CGSL Local Security Checks	critical
149918	Oracle Linux 8 : grafana (ELSA-2021-1859)	Nessus	Oracle Linux Local Security Checks	critical
149734	CentOS 8 : grafana (CESA-2021:1859)	Nessus	CentOS Local Security Checks	critical
149689	RHEL 8 : grafana (RHSA-2021:1859)	Nessus	Red Hat Local Security Checks	critical
144736	Fedora 32 : grafana (2020-968067abfa)	Nessus	Fedora Local Security Checks	critical
144717	Fedora 33 : grafana (2020-64e54abd9f)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2020-27846

critical

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical