Google Sheets data source plugin for Grafana information disclosure vulnerability

高 7.5CVE-2023-4457 · GHSA-37x5-qpm8-53rq · GO-2023-2158 · 16/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-4457 は github.com/grafana/google-sheets-datasource, google sheets (grafana) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.46%（全脆弱性の 40.2% より高い）。
対処：1.2.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/grafana/google-sheets-datasource Go	`≥ 0.9.0, < 1.2.2`	`1.2.2`
google sheets grafana	`≥ 0.9.0, ≤ 1.2.2`	修正版なし

概要

Grafana is an open-source platform for monitoring and observability.

The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability.

The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source.

This vulnerability was fixed in version 1.2.2.

NVD の説明

Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerability was fixed in version 1.2.2.