CVE-2018-9090

CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator…

published September 24, 2019

CVSS
—
EPSS
1%
Percentile
55.6
In the wild
Unconfirmed
What it is

CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00793 · 55.6th percentile
Published
2019-09-24T13:38Z
EPSS history
Timeline
  • 24 SEP 13:38Z
    CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator…
    cvelistv5