Handling Grafana vulnerability on ConnectALL server due to old version of Insights

Products

• ConnectAll On-Prem
• ConnectALL

Issue/Introduction

There are instances that customers have installed Insights Analytics as part of ConnectALL installation and did the required configurations. However, over the time only ConnectALL is upgraded to the latest version but Insights is not upgraded as it is not being used.

In such cases, you are likely to get alerts about the vulnerabilities on Grafana due to it's old version. The tool being used for scanning might find Grafana under ConnectALL base directory or any backup locations.

In order to address those vulnerabilities, you may choose to upgrade Grafana or Uninstall Insights Analytics.

Environment

2.11.x - 3.x

Resolution

Below are the steps to uninstall/unbundle Insights Analytics from your ConnectALL install.

1. Stop ConnectALL insights analytics service.
2. Find the service name by going to properties of the service and running below command in Command Prompt. ConnectALL 2.11 has ca_insights_analytics and later version has it named connectall-insightsanalytics 
   1. sc delete ca_insights_analytics
3. Verify the service is deleted from services by refreshing it.
4. In ConnectALL base directory, you will see folder called ConnectALL_Insights_Analytics. Delete the folder as it contains Grafana configurations for Insights. This will stop the alerts/vulnerability in the scans.
5. Look for any ConnectALL installation directory backups and delete ConnectALL_Insights_Analytics from there as well.
6. Additional steps can be performed in ConnectALL UI to delete any Insights DB connection and associated automations present.

 

Please refer below KB article to manually upgrade Grafana

Manually Upgrade Grafana