<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for grafana and system-user-grafana</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2021:1233-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2021-04-15T15:21:15Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-04-15T15:21:15Z</InitialReleaseDate>
    <CurrentReleaseDate>2021-04-15T15:21:15Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for grafana and system-user-grafana</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for grafana and system-user-grafana fixes the following issues:

- Updated grafana to upstream version 7.3.1
  * CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
    This makes it possible to run a denial of service attack against the server running Grafana
  * CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)
  * CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.
    This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and
    return its result to the user/client. This can be used to gain information about the network that Grafana is
    running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)
  * CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
    This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)
  * CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)
  * CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)
  * CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard &gt; Text Panel' screen (bsc#1172450)
  * CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which
    could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)

  * Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)

- Initial shipment of system-user-grafana to SES 6</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Container caasp/v4/grafana:7.5.12-2021-1233,SUSE-2021-1233,SUSE-SLE-Manager-Tools-15-2021-1233,SUSE-Storage-6-2021-1233</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      <Description>Link for SUSE-SU-2021:1233-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2021-April/008643.html</URL>
      <Description>E-Mail link for SUSE-SU-2021:1233-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1148383</URL>
      <Description>SUSE Bug 1148383</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1170557</URL>
      <Description>SUSE Bug 1170557</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1170657</URL>
      <Description>SUSE Bug 1170657</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1172409</URL>
      <Description>SUSE Bug 1172409</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1172450</URL>
      <Description>SUSE Bug 1172450</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1175951</URL>
      <Description>SUSE Bug 1175951</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1178243</URL>
      <Description>SUSE Bug 1178243</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-18623/</URL>
      <Description>SUSE CVE CVE-2018-18623 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-15043/</URL>
      <Description>SUSE CVE CVE-2019-15043 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-19499/</URL>
      <Description>SUSE CVE CVE-2019-19499 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-12052/</URL>
      <Description>SUSE CVE CVE-2020-12052 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-12245/</URL>
      <Description>SUSE CVE CVE-2020-12245 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-13379/</URL>
      <Description>SUSE CVE CVE-2020-13379 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-24303/</URL>
      <Description>SUSE CVE CVE-2020-24303 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Container caasp/v4/grafana:7.5.12">
      <Branch Type="Product Name" Name="Container caasp/v4/grafana:7.5.12">
        <FullProductName ProductID="Container caasp/v4/grafana:7.5.12">Container caasp/v4/grafana:7.5.12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 6">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 6">
        <FullProductName ProductID="SUSE Enterprise Storage 6" CPE="cpe:/o:suse:ses:6">SUSE Enterprise Storage 6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Tools 15">
      <Branch Type="Product Name" Name="SUSE Manager Tools 15">
        <FullProductName ProductID="SUSE Manager Tools 15" CPE="cpe:/o:suse:sle-manager-tools:15">SUSE Manager Tools 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="system-user-grafana-1.0.0-3.9.1">
      <FullProductName ProductID="system-user-grafana-1.0.0-3.9.1">system-user-grafana-1.0.0-3.9.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="grafana-7.3.1-3.6.1">
      <FullProductName ProductID="grafana-7.3.1-3.6.1">grafana-7.3.1-3.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="system-user-grafana-1.0.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="Container caasp/v4/grafana:7.5.12">
      <FullProductName ProductID="Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1">system-user-grafana-1.0.0-3.9.1 as a component of Container caasp/v4/grafana:7.5.12</FullProductName>
    </Relationship>
    <Relationship ProductReference="grafana-7.3.1-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 6">
      <FullProductName ProductID="SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1">grafana-7.3.1-3.6.1 as a component of SUSE Enterprise Storage 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="system-user-grafana-1.0.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 6">
      <FullProductName ProductID="SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1">system-user-grafana-1.0.0-3.9.1 as a component of SUSE Enterprise Storage 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="system-user-grafana-1.0.0-3.9.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Tools 15">
      <FullProductName ProductID="SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1">system-user-grafana-1.0.0-3.9.1 as a component of SUSE Manager Tools 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Grafana 5.3.1 has XSS via the "Dashboard &gt; Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.</Note>
    </Notes>
    <CVE>CVE-2018-18623</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-18623.html</URL>
        <Description>CVE-2018-18623</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1172450</URL>
        <Description>SUSE Bug 1172450</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1174583</URL>
        <Description>SUSE Bug 1174583</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175951</URL>
        <Description>SUSE Bug 1175951</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.</Note>
    </Notes>
    <CVE>CVE-2019-15043</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-15043.html</URL>
        <Description>CVE-2019-15043</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1148383</URL>
        <Description>SUSE Bug 1148383</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Grafana &lt;= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.</Note>
    </Notes>
    <CVE>CVE-2019-19499</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-19499.html</URL>
        <Description>CVE-2019-19499</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1175951</URL>
        <Description>SUSE Bug 1175951</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Grafana version &lt; 6.7.3 is vulnerable for annotation popup XSS.</Note>
    </Notes>
    <CVE>CVE-2020-12052</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-12052.html</URL>
        <Description>CVE-2020-12052</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1170657</URL>
        <Description>SUSE Bug 1170657</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.</Note>
    </Notes>
    <CVE>CVE-2020-12245</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-12245.html</URL>
        <Description>CVE-2020-12245</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1170557</URL>
        <Description>SUSE Bug 1170557</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.</Note>
    </Notes>
    <CVE>CVE-2020-13379</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-13379.html</URL>
        <Description>CVE-2020-13379</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1172409</URL>
        <Description>SUSE Bug 1172409</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.</Note>
    </Notes>
    <CVE>CVE-2020-24303</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container caasp/v4/grafana:7.5.12:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:grafana-7.3.1-3.6.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:system-user-grafana-1.0.0-3.9.1</ProductID>
        <ProductID>SUSE Manager Tools 15:system-user-grafana-1.0.0-3.9.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-24303.html</URL>
        <Description>CVE-2020-24303</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1178243</URL>
        <Description>SUSE Bug 1178243</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
