PT-2023-8916 · Grafana +1 · Grafana Google Sheets Data Source Plugin +1

🗓️ 16 Oct 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 2 Views

Grafana Google Sheets data source plugin 0.9.0–1.2.1 discloses API keys in errors; update to 1.2.2 or restrict access.

Reporter	Title	Published	Views	Family All 105
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to the Exposure of Sensitive Information to an Unauthorized Actor in Grafana (CVE-2022-23498)	31 Jul 202414:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Cross-site Scripting in Grafana (CVE-2023-0594)	1 Nov 202319:59	–	ibm
AlpineLinux	CVE-2023-0594	1 Mar 202316:15	–	alpinelinux
BDU FSTEC	The vulnerability of the Grafana data visualization web tool lies in the lack of protection for operational data, allowing attackers to gain access to the current user’s session.	6 Mar 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Grafana data visualization web tool, related to insufficient cleaning of user data, allows attackers to execute cross-site scripting (XSS) attacks.	29 Mar 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Trace View web instrumentation panel in Grafana allows attackers to escalate their privileges and perform cross-site scripting attacks.	2 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Google Sheets platform for monitoring and observation by Grafana involves the generation of error messages containing confidential information, which allows attackers to gain access to confidential data.	4 Apr 202400:00	–	bdu_fstec
Chainguard	CVE-2023-0594 vulnerabilities	1 Mar 202316:15	–	cgr
Circl	CVE-2022-23498	5 Mar 202520:01	–	circl

Source	Link
bdu	www.bdu.fstec.ru/vul/2024-02600
grafana	www.grafana.com/security/security-advisories/cve-2023-4457
osv	www.osv.dev/vulnerability/GHSA-37x5-qpm8-53rq
osv	www.osv.dev/vulnerability/CVE-2023-4457
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-4457
osv	www.osv.dev/vulnerability/GO-2023-2158
github	www.github.com/grafana/google-sheets-datasource
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-cve-2023-4457-cve-2022-23498-cve-2023-0594
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-03-04-24
redos	www.redos.red-soft.ru/support/secure

03 Apr 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 27.8

CVSS 3.17.3 - 8.8

EPSS0.09216

SSVC