CoreOS Tectonic 1.7.x and 1.8.x prior to 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
redhat tectonic |
Vulmon