Bug 1850572 (CVE-2018-18624) - CVE-2018-18624 grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen
Summary: CVE-2018-18624 grafana: XSS vulnerability via a column style on the "Dashboar...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-18624
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1850573 1851885 1852023 1852024 1852025 1852026 1852260 1852261
Blocks: 1850581
TreeView+ depends on / blocked
 
Reported: 2020-06-24 13:48 UTC by Michael Kaplan
Modified: 2021-06-10 14:20 UTC (History)
24 users (show)

Fixed In Version: grafana 6.7.3, grafana 7.0.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the "Dashboard > Table Panel" screen.
Clone Of:
Environment:
Last Closed: 2020-10-27 20:21:23 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4298 0 None None None 2020-10-27 16:24:34 UTC
Red Hat Product Errata RHSA-2020:4682 0 None None None 2020-11-04 02:59:46 UTC

Description Michael Kaplan 2020-06-24 13:48:55 UTC 
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

https://github.com/grafana/grafana/pull/11813
https://security.netapp.com/advisory/ntap-20200608-0008/
Comment 1 Michael Kaplan 2020-06-24 13:49:14 UTC 
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1850573]
Comment 2 Mark Cooper 2020-06-26 04:34:00 UTC 
Upstream commit: https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e
Comment 3 Mark Cooper 2020-06-26 04:45:55 UTC 
ServiceMesh packages a vulnerable version of grafana v6.4.3 in the openshift-service-mesh/grafana-rhel8 container.
Comment 7 Przemyslaw Roguski 2020-06-29 15:34:39 UTC 
upstream PR: https://github.com/grafana/grafana/pull/23816
Comment 11 Mark Cooper 2020-06-30 08:11:31 UTC 
Statement:

Both OpenShift 3.11 and 4.x grafana-container's package a vulnerable version of grafana. However the grafana instance is set to read-only meaning that the potential XSS attack cannot be performed as the table panel cannot be modified or added. As OpenShift still packages the vulnerable code, the components are affected but with impact Low.

In OpenShift ServiceMesh the grafana component is a vulnerable version, however as it is behind OpenShift OAuth restricting access to authenticated users only the impact is Low.
Comment 12 Hardik Vyas 2020-06-30 11:41:59 UTC 
External References:

https://security.netapp.com/advisory/ntap-20200608-0008/
Comment 14 errata-xmlrpc 2020-10-27 16:24:30 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298
Comment 15 Product Security DevOps Team 2020-10-27 20:21:23 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-18624
Comment 16 errata-xmlrpc 2020-11-04 02:59:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4682 https://access.redhat.com/errata/RHSA-2020:4682
Note You need to log in before you can comment on or make changes to this bug.