Security Advisory

CVE-2018-9090

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2019-09-24 13:38:56

Last updated 2024-08-05 07:17:50

Assigner mitre

State PUBLISHED

Description

CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.

← Browse all CVEs View on cve.org ↗