CVE-2019-15043
Publicada em · Atualizada em
30Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendepss 63%
probabilidade de exploração
63%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
5 produtos (8 componentes)
Red Hat Ceph Storage 2 · Red Hat Ceph Storage 3 · Red Hat Storage 3 · Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4
workaround: Block access to the snapshot feature by blocking the /api/snapshots URL via a web application firewall, load balancer, reverse proxy etc. You can also set 'external_enabled' to false to disable external snapshot publish endpoint (default true)…
Corrigido
In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.
Produtos afetados
n/a · n/aReferências
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.htmlhttps://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569https://community.grafana.com/t/release-notes-v6-3-x/19202https://github.com/grafana/grafana/releaseshttps://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RF5ARGYX3WYB7H2FDR7VAWTEQ27UX3FU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO4NBL7PKW4OSFRVZENGC42EWEJV2YAH/https://security.netapp.com/advisory/ntap-20191004-0004/