The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4682 advisory.

  - An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana     and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive     information (e.g., cleartext or encrypted datasource passwords). (CVE-2020-12458)

  - Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. (CVE-2020-12245)

  - Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated     attacker that has privileges to modify the data source configurations. (CVE-2019-19499)

  - Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. (CVE-2020-13430)

  - Grafana 5.3.1 has XSS via a column style on the Dashboard > Table Panel screen. NOTE: this issue exists     because of an incomplete fix for CVE-2018-12099. (CVE-2018-18624)

  - Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field,     which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original     Dashboard after visiting the snapshot. (CVE-2020-11110)

  - Grafana version < 6.7.3 is vulnerable for annotation popup XSS. (CVE-2020-12052)

  - In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files     /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are     world readable. (CVE-2020-12459)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4682 advisory.

  - grafana: XSS vulnerability via a column style on the Dashboard > Table Panel screen (CVE-2018-18624)

  - grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

  - grafana: stored XSS (CVE-2020-11110)

  - grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  - grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  - grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

  - grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  - grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has grafana packages installed that are affected by multiple vulnerabilities:

  - An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana     and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive     information (e.g., cleartext or encrypted datasource passwords). (CVE-2020-12458)

  - In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files     /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are     world readable. (CVE-2020-12459)

  - Grafana version < 6.7.3 is vulnerable for annotation popup XSS. (CVE-2020-12052)

  - Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. (CVE-2020-13430)

  - Grafana 5.3.1 has XSS via a column style on the Dashboard > Table Panel screen. NOTE: this issue exists     because of an incomplete fix for CVE-2018-12099. (CVE-2018-18624)

  - Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. (CVE-2020-12245)

  - Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field,     which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original     Dashboard after visiting the snapshot. (CVE-2020-11110)

  - Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated     attacker that has privileges to modify the data source configurations. (CVE-2019-19499)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4682 advisory.

  - Grafana 5.3.1 has XSS via a column style on the Dashboard > Table Panel screen. NOTE: this issue exists     because of an incomplete fix for CVE-2018-12099. (CVE-2018-18624)

  - Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated     attacker that has privileges to modify the data source configurations. (CVE-2019-19499)

  - Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field,     which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original     Dashboard after visiting the snapshot. (CVE-2020-11110)

  - Grafana version < 6.7.3 is vulnerable for annotation popup XSS. (CVE-2020-12052)

  - Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. (CVE-2020-12245)

  - An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana     and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive     information (e.g., cleartext or encrypted datasource passwords). (CVE-2020-12458)

  - In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files     /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are     world readable. (CVE-2020-12459)

  - Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. (CVE-2020-13430)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

rebase to upstream Grafana 6.7.3

  - including fix for CVE-2020-12458 and CVE-2020-12459

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory.

  - nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties     (CVE-2019-10744)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4682 advisory.

  - grafana: XSS vulnerability via a column style on the Dashboard > Table Panel screen (CVE-2018-18624)

  - grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

  - grafana: stored XSS (CVE-2020-11110)

  - grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  - grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  - grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

  - grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  - grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
142792	Oracle Linux 8 : grafana (ELSA-2020-4682)	Nessus	Oracle Linux Local Security Checks	11/12/2020	2/9/2024	medium
145918	CentOS 8 : grafana (CESA-2020:4682)	Nessus	CentOS Local Security Checks	2/1/2021	1/24/2024	medium
147708	NewStart CGSL MAIN 6.02 : grafana Multiple Vulnerabilities (NS-SA-2021-0066)	Nessus	NewStart CGSL Local Security Checks	3/11/2021	1/9/2024	medium
157665	AlmaLinux 8 : grafana (ALSA-2020:4682)	Nessus	Alma Linux Local Security Checks	2/9/2022	11/10/2023	medium
136595	Fedora 31 : grafana (2020-d109a1d1d9)	Nessus	Fedora Local Security Checks	5/14/2020	3/12/2024	medium
137064	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)	Nessus	Red Hat Local Security Checks	6/3/2020	1/23/2023	critical
142416	RHEL 8 : grafana (RHSA-2020:4682)	Nessus	Red Hat Local Security Checks	11/4/2020	2/9/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical

medium