Back to bug 2168038
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| Avinash Hanwate | 2023-02-08 05:14:48 UTC | CC | security-response-team | |
| Sandipan Roy | 2023-02-08 05:16:49 UTC | CC | amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, jkurik, jwendell, mbenjamin, mhackett, nathans, njean, ovanders, owatkins, pahickey, rcernich, scox, sostapov, stcannon, teagle, vereddy | |
| Avinash Hanwate | 2023-02-08 05:18:02 UTC | Blocks | 2168039 | |
| Avinash Hanwate | 2023-02-08 05:20:16 UTC | Doc Text | A flaw was found in the GeoMap Grafana plugin. It was discovered that one can store unsanitized HTML in the GeoMap plugin under the Attribution text field and it will be processed by the client. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with the editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus getting access to the admin account (so the editor would become an admin as an end result). | |
| RaTasha Tillery-Smith | 2023-02-08 13:02:12 UTC | Doc Text | A flaw was found in the GeoMap Grafana plugin. It was discovered that one can store unsanitized HTML in the GeoMap plugin under the Attribution text field and it will be processed by the client. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with the editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus getting access to the admin account (so the editor would become an admin as an end result). | A flaw was found in the GeoMap Grafana plugin, where a user can store unsanitized HTML in the GeoMap plugin under the Attribution text field, and the client will process it. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus gaining access to the admin account and resulting as the editor becoming an admin. |
| Avinash Hanwate | 2023-02-21 10:48:09 UTC | Group | team ocp_embargoes | |
| Avinash Hanwate | 2023-02-21 10:51:16 UTC | Depends On | 2172061 | |
| TEJ RATHI | 2023-02-23 04:46:07 UTC | CC | dfreiber, jburrell, rogbas, vkumar | |
| TEJ RATHI | 2023-02-23 04:46:39 UTC | Depends On | 2172773 | |
| Guilherme de Almeida Suckevicz | 2023-03-01 18:24:24 UTC | Group | security, qe_staff, team ocp_embargoes | |
| CC | grafana-maint | |||
| Summary | EMBARGOED CVE-2023-0507 grafana: cross site scripting | CVE-2023-0507 grafana: cross site scripting | ||
| Guilherme de Almeida Suckevicz | 2023-03-01 18:24:43 UTC | Depends On | 2174477 | |
| Red Hat Bugzilla | 2023-07-07 08:34:46 UTC | CC | security-response-team | |
| Assignee | security-response-team | nobody |
Back to bug 2168038