Bug 1850575 (CVE-2018-18625) - CVE-2018-18625 grafana: XSS vulnerability via a link on the "Dashboard > All Panels > General" screen
Summary: CVE-2018-18625 grafana: XSS vulnerability via a link on the "Dashboard > All ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-18625
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1850584 1852264 1852346 1852347 1852348 1852349
Blocks: 1850581
TreeView+ depends on / blocked
 
Reported: 2020-06-24 13:50 UTC by Michael Kaplan
Modified: 2021-10-28 08:24 UTC (History)
25 users (show)

Fixed In Version: grafana 6.3.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the "Dashboard > All Panels > General" screen.
Clone Of:
Environment:
Last Closed: 2021-10-28 08:24:40 UTC
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2020-06-24 13:50:33 UTC 
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

https://github.com/grafana/grafana/pull/11813
https://security.netapp.com/advisory/ntap-20200608-0008/
Comment 1 Michael Kaplan 2020-06-24 13:54:05 UTC 
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1850584]
Comment 3 Mark Cooper 2020-06-29 03:50:00 UTC 
This vulnerability actually applies to the "dashboard" field at "Home > Edit Panel > Add Link > General > Dashboard" after the dashboard title has been set: https://github.com/grafana/grafana/pull/11813#issuecomment-458000030
Comment 9 Mark Cooper 2020-06-30 07:03:55 UTC 
OpenShift packages a vulnerable version of grafana:
  - OpenShift 3.11 grafana v5.2.3

ServiceMesh also packages a vulnerable version:
  - ServiceMesh 1.0.x grafana v6.2.2

For Openshift 4.x and SeviceMesh 1.1.x the version of grafana is 6.4.3 and is not vulnerable.
Comment 15 Mauro Matteo Cascella 2020-06-30 15:17:26 UTC 
Statement:

While OpenShift 3.11 grafana-container packages a vulnerable version of grafana, the dashboard is set to read-only meaning that the vulnerable component cannot be added or modified to contain the potential XSS. As OpenShift still packages the vulnerable code, the component is affected but with impact Low.

In OpenShift ServiceMesh 1.0 the grafana component is a vulnerable version, however as it is behind OpenShift OAuth restricting access to authenticated users only the impact is Low.

Red Hat Enterprise Linux 8 is not affected by this flaw, as it ships a newer version of grafana which does not include the vulnerable code.
Comment 16 Mark Cooper 2020-07-01 01:22:06 UTC 
@proguski has confirmed with upstream that this vulnerability was fixed in v6.3.0 as per this comment: https://github.com/grafana/grafana/pull/22680#issuecomment-651195921
Comment 17 Mark Cooper 2020-07-01 01:22:12 UTC 
External References:

https://security.netapp.com/advisory/ntap-20200608-0008/
https://github.com/grafana/grafana/pull/22680#issuecomment-651195921
Note You need to log in before you can comment on or make changes to this bug.