system-user-grafana (SUSE:Manager Client Tools 15) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Client Tools 15 package system-user-grafana, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (7)

• CVE-2020-13379 — CVSS 8.2 (high): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated…
• CVE-2019-15043 — CVSS 7.5 (high): In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service…
• CVE-2019-19499 — CVSS 6.5 (medium): Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to…
• CVE-2020-24303 — CVSS 6.1 (medium): Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
• CVE-2020-12052 — CVSS 6.1 (medium): Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
• CVE-2018-18623 — CVSS 6.1 (medium): Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
• CVE-2020-12245 — CVSS 6.1 (medium): Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.