Bug 1850575 (CVE-2018-18625) - CVE-2018-18625 grafana: XSS vulnerability via a link on the "Dashboard > All Panels > General" screen
Summary: CVE-2018-18625 grafana: XSS vulnerability via a link on the "Dashboard > All ...
Alias: CVE-2018-18625
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1850584 1852264 1852346 1852347 1852348 1852349
Blocks: 1850581
TreeView+ depends on / blocked
Reported: 2020-06-24 13:50 UTC by Michael Kaplan
Modified: 2021-10-28 08:24 UTC (History)
25 users (show)

Fixed In Version: grafana 6.3.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the "Dashboard > All Panels > General" screen.
Clone Of:
Last Closed: 2021-10-28 08:24:40 UTC

Attachments (Terms of Use)

Description Michael Kaplan 2020-06-24 13:50:33 UTC
Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.


Comment 1 Michael Kaplan 2020-06-24 13:54:05 UTC
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1850584]

Comment 3 Mark Cooper 2020-06-29 03:50:00 UTC
This vulnerability actually applies to the "dashboard" field at "Home > Edit Panel > Add Link > General > Dashboard" after the dashboard title has been set: https://github.com/grafana/grafana/pull/11813#issuecomment-458000030

Comment 9 Mark Cooper 2020-06-30 07:03:55 UTC
OpenShift packages a vulnerable version of grafana:
  - OpenShift 3.11 grafana v5.2.3

ServiceMesh also packages a vulnerable version:
  - ServiceMesh 1.0.x grafana v6.2.2

For Openshift 4.x and SeviceMesh 1.1.x the version of grafana is 6.4.3 and is not vulnerable.

Comment 15 Mauro Matteo Cascella 2020-06-30 15:17:26 UTC

While OpenShift 3.11 grafana-container packages a vulnerable version of grafana, the dashboard is set to read-only meaning that the vulnerable component cannot be added or modified to contain the potential XSS. As OpenShift still packages the vulnerable code, the component is affected but with impact Low.

In OpenShift ServiceMesh 1.0 the grafana component is a vulnerable version, however as it is behind OpenShift OAuth restricting access to authenticated users only the impact is Low.

Red Hat Enterprise Linux 8 is not affected by this flaw, as it ships a newer version of grafana which does not include the vulnerable code.

Comment 16 Mark Cooper 2020-07-01 01:22:06 UTC
@proguski has confirmed with upstream that this vulnerability was fixed in v6.3.0 as per this comment: https://github.com/grafana/grafana/pull/22680#issuecomment-651195921

Note You need to log in before you can comment on or make changes to this bug.