Vulnerability CVE-2020-13429

Vulnerability Name:

CVE-2020-13429 (CCN-182418)

Assigned:

2020-02-05

Published:

2020-02-05

Updated:

2020-05-26

Summary:

legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) option.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2020-13429

Source: XF
Type: UNKNOWN
grafana-piechartpanel-cve202013429-xss(182418)

Source: CCN
Type: piechart-panel GIT Repository
XSS flaw in piechart panel #218

Source: MISC
Type: Issue Tracking, Third Party Advisory
https://github.com/grafana/piechart-panel/issues/218

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/grafana/piechart-panel/releases/tag/v1.5.0

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-13429

Vulnerable Configuration:

Configuration 1:

cpe:/a:grafana:piechart-panel:*:*:*:*:*:grafana:*:* (Version < 1.5.0)

Configuration CCN 1:

cpe:/a:grafana:grafana:6.7.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:95387	P	Security update for google-gson (Important)	2022-06-10
oval:org.opensuse.security:def:102100	P	Security update for MozillaThunderbird (Important)	2022-03-10
oval:org.opensuse.security:def:112354	P	grafana-piechart-panel-1.6.1-2.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:6177	P	Security update for the Linux Kernel (Important)	2022-01-13
oval:org.opensuse.security:def:105867	P	Security update for aaa_base (Moderate)	2021-12-03
oval:org.opensuse.security:def:111069	P	Security update for grafana-piechart-panel (Moderate)	2021-09-25
oval:org.opensuse.security:def:75996	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:108766	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:76334	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:100051	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:5839	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:66928	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:111719	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21
oval:org.opensuse.security:def:67266	P	Security update for grafana-piechart-panel (Moderate)	2021-09-21

BACK