diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index ae2e7d778fb9..83448500b89e 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,73 @@ + + Grafana -- Incorrect Access Control + + + grafana8 + grafana + 8.0.08.2.4 + + + + +

Grafana Labs reports:

+
On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.
+

+ + + + CVE-2021-41244 + https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/ + + + 2021-11-02 + 2021-11-18 + + + + + Grafana -- XSS + + + grafana8 + grafana + 8.0.08.2.3 + + + + +

Grafana Labs reports:

+
If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim’s browser.
+
The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.
+
There are two ways an unauthenticated user can open a page in Grafana that contains the login button:
+
+
Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.
+
The link is to an unauthenticated page. The following pages are vulnerable: +
+
/dashboard-solo/snapshot/*
+
/dashboard/snapshot/*
+
/invite/:code
+
+
+
+
The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }}
+
An example of an expression would be: {{constructor.constructor(‘alert(1)’)()}}. This can be included in the link URL like this:
+
https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1
+
When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.
+

+ + + + CVE-2021-41174 + https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/ + + + 2021-10-21 + 2021-11-17 + + + chromium -- multiple vulnerabilities