The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0545-1 advisory.

    grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):

    - Security issues fixed:
      * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading         golang.org/x/crypto (bsc#1234554)
      * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
      * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
      * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
      * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)

    - Potential breaking changes in version 10:
      * In panels using the `extract fields` transformation, where one         of the extracted names collides with one of the already         existing ields, the extracted field will be renamed.
      * For the existing backend mode users who have table         visualization might see some inconsistencies on their panels.
        We have updated the table column naming. This will         potentially affect field transformations and/or field         overrides. To resolve this either: update transformation or         field override.
      * For the existing backend mode users who have Transformations         with the `time` field, might see their transformations are         not working. Those panels that have broken transformations         will fail to render. This is because we changed the field         key. To resolve this either: Remove the affected panel and         re-create it; Select the `Time` field again; Edit the `time`         field as `Time` for transformation in `panel.json` or         `dashboard.json`
      * The following data source permission endpoints have been removed:
        `GET /datasources/:datasourceId/permissions`         `POST /api/datasources/:datasourceId/permissions`         `DELETE /datasources/:datasourceId/permissions`         `POST /datasources/:datasourceId/enable-permissions`         `POST /datasources/:datasourceId/disable-permissions`
        - Please use the following endpoints instead:
          `GET /api/access-control/datasources/:uid` for listing data            source permissions           `POST /api/access-control/datasources/:uid/users/:id`,           `POST /api/access-control/datasources/:uid/teams/:id` and           `POST /api/access-control/datasources/:uid/buildInRoles/:id`           for adding or removing data source permissions
      * If you are using Terraform Grafana provider to manage data source permissions, you will need to     upgrade your         provider.
      * For the existing backend mode users who have table visualization might see some inconsistencies on     their panels.
        We have updated the table column naming. This will potentially affect field transformations and/or     field overrides.
      * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
        Dashboard information can be retrieved from the `/dashboard/...` APIs.
      * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
      * Removed all components for the old panel header design.
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/         for more details
      * OAuth role mapping enforcement: This change impacts GitHub,         Gitlab, Okta, and Generic OAuth. To avoid overriding manually         set roles, enable the skip_org_role_sync option in the         Grafana configuration for your OAuth provider before         upgrading
      * Angular has been deprecated
      * Grafana legacy alerting has been deprecated
      * API keys are migrating to service accounts
      * The experimental dashboard previews feature is removed
      * Usernames are now case-insensitive by default
      * Grafana OAuth integrations do not work anymore with email lookups
      * The Alias field in the CloudWatch data source is removed
      * Athena data source plugin must be updated to version >=2.9.3
      * Redshift data source plugin must be updated to version >=1.8.3
      * DoiT International BigQuery plugin no longer supported
      * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0         for more details

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0286 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-3128:
      Grafana is validating Azure AD accounts based on the email claim.
      On Azure AD, the profile email field is not unique and can be easily modified.
      This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-     tenant app.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3925 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, bug fixes, and known issues. Space precludes documenting     all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for     information on the most significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/7.1/html/release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:4030 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-4030 advisory.

    [9.0.9-3]
    - resolve CVE-2023-3128 grafana: Remove Email Lookup from oauth integrations       (rhbz#2213701 rhbz#2213626)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:4030 advisory.

  - Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is     not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure     AD OAuth is configured with a multi-tenant app. (CVE-2023-3128)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
216397	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:0545-1)	Nessus	SuSE Local Security Checks	2025/2/17	2025/6/5	medium
239562	TencentOS Server 3: grafana (TSSA-2023:0286)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
200554	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2024:3925)	Nessus	Red Hat Local Security Checks	2024/6/14	2024/11/7	critical
178194	AlmaLinux 9 : grafana (ALSA-2023:4030)	Nessus	Alma Linux Local Security Checks	2023/7/12	2023/11/2	critical
178577	Oracle Linux 9 : grafana (ELSA-2023-4030)	Nessus	Oracle Linux Local Security Checks	2023/7/20	2025/9/9	critical
178491	Rocky Linux 9 : grafana (RLSA-2023:4030)	Nessus	Rocky Linux Local Security Checks	2023/7/19	2023/11/2	critical

检测

插件搜索

medium

critical

critical

critical

critical

critical