2 lines
4.0 KiB
JSON
2 lines
4.0 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"grafana-csv-datasource","repo":"https://github.com/grafana/grafana-csv-datasource","vendor":"Grafana","versions":[{"lessThan":"0.6.13","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"security@grafana.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","matchCriteriaId":"69CFB8EE-4993-4F22-8A94-AE0000243671","versionEndExcluding":"0.6.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g. https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator"},{"lang":"es","value":"Grafana es una plataforma de código abierto para monitoreo y observabilidad. El complemento de fuente de datos CSV es un complemento mantenido por Grafana Labs para Grafana que permite recuperar y procesar datos CSV desde un endpoint remoto configurado por un administrador. Si este complemento se configuró para enviar solicitudes a un host simple sin ruta (por ejemplo, https://www.example.com/ https://www.example.com/`), las solicitudes a un endpoint distinto al configurado por el administrador podría activarse mediante una solicitud especialmente manipulada por parte de cualquier usuario, lo que daría como resultado un vector SSRF. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator"}],"id":"CVE-2023-5122","lastModified":"2026-06-17T06:47:34.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"security@grafana.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2023-5122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-02-26T16:45:27.784995Z","version":"2.0.3"}}]},"published":"2024-02-14T15:15:08.437","references":[{"source":"security@grafana.com","tags":["Vendor Advisory"],"url":"https://grafana.com/security/security-advisories/cve-2023-5122/"},{"source":"security@grafana.com","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20240503-0002/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://grafana.com/security/security-advisories/cve-2023-5122/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20240503-0002/"}],"sourceIdentifier":"security@grafana.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@grafana.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-918"}],"source":"nvd@nist.gov","type":"Primary"}]}
|