Action not permitted
Modal body text goes here.
CVE-2022-23552
Vulnerability from cvelistv5
Published
2023-01-27 22:59
Modified
2024-08-03 03:43
Severity ?
EPSS score ?
Summary
Grafana stored XSS in FileUploader component
References
▼ | URL | Tags | |
---|---|---|---|
security-advisories@github.com | https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0 | Patch, Third Party Advisory | |
security-advisories@github.com | https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f | Patch, Third Party Advisory | |
security-advisories@github.com | https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a | Patch, Third Party Advisory | |
security-advisories@github.com | https://github.com/grafana/grafana/pull/62143 | Patch, Third Party Advisory | |
security-advisories@github.com | https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv | Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T03:43:46.570Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "https://security.netapp.com/advisory/ntap-20230302-0008/" }, { "name": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv" }, { "name": "https://github.com/grafana/grafana/pull/62143", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/grafana/grafana/pull/62143" }, { "name": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0" }, { "name": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f" }, { "name": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a", "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2022-23552", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-01T14:04:19.237399Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-01T14:04:27.841Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "grafana", "vendor": "grafana", "versions": [ { "status": "affected", "version": "\u003e= 9.0, \u003c 9.2.10" }, { "status": "affected", "version": "\u003e= 9.3, \u003c 9.3.4" }, { "status": "affected", "version": "\u003e= 8.1, \u003c 8.5.16" } ] } ], "descriptions": [ { "lang": "en", "value": "Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. \n\nAn attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. \n\nUsers may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-01-27T22:59:16.675Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv" }, { "name": "https://github.com/grafana/grafana/pull/62143", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/grafana/grafana/pull/62143" }, { "name": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0" }, { "name": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f" }, { "name": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a", "tags": [ "x_refsource_MISC" ], "url": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a" } ], "source": { "advisory": "GHSA-8xmm-x63g-f6xv", "discovery": "UNKNOWN" }, "title": "Grafana stored XSS in FileUploader component " } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-23552", "datePublished": "2023-01-27T22:59:16.675Z", "dateReserved": "2022-01-19T21:23:53.801Z", "dateUpdated": "2024-08-03T03:43:46.570Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-23552\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-01-27T23:15:08.597\",\"lastModified\":\"2023-11-07T03:44:13.663\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. \\n\\nAn attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. \\n\\nUsers may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.\"},{\"lang\":\"es\",\"value\":\"Grafana es una plataforma de c\u00f3digo abierto para monitoreo y observabilidad. A partir de la rama 8.1 y antes de las versiones 8.5.16, 9.2.10 y 9.3.4, Grafana ten\u00eda una vulnerabilidad XSS almacenada que afectaba al complemento principal GeoMap. La vulnerabilidad XSS almacenada fue posible porque los archivos SVG no se desinfectaron adecuadamente y permitieron la ejecuci\u00f3n de JavaScript arbitrario en el contexto del usuario actualmente autorizado de la instancia de Grafana. Un atacante debe tener la funci\u00f3n de Editor para cambiar un panel para incluir una URL externa a un archivo SVG que contenga JavaScript o usar el esquema `datos:` para cargar un archivo SVG en l\u00ednea que contenga JavaScript. Esto significa que es posible una escalada de privilegios vertical, donde un usuario con rol de editor puede cambiar a una contrase\u00f1a conocida para un usuario que tiene rol de administrador si el usuario con rol de administrador ejecuta JavaScript malicioso al ver un panel. Los usuarios pueden actualizar a la versi\u00f3n 8.5.16, 9.2.10 o 9.3.4 para recibir una soluci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0\",\"versionEndExcluding\":\"8.5.16\",\"matchCriteriaId\":\"5BD0E7E3-A021-4B47-82B2-761FEBA27EFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.2.10\",\"matchCriteriaId\":\"7CAA5402-01AD-4FF5-AABE-B227C035F1F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"9.3.4\",\"matchCriteriaId\":\"E8642012-7942-4810-8DB0-1894D3BF4662\"}]}]}],\"references\":[{\"url\":\"https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/grafana/grafana/pull/62143\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
wid-sec-w-2023-0202
Vulnerability from csaf_certbund
Published
2023-01-25 23:00
Modified
2024-01-23 23:00
Summary
Grafana: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen falsch darzustellen und seine Privilegien zu erweitern.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, Informationen falsch darzustellen und seine Privilegien zu erweitern.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-0202 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0202.json" }, { "category": "self", "summary": "WID-SEC-2023-0202 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0202" }, { "category": "external", "summary": "Grafana security releases vom 2023-01-25", "url": "https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0812-1 vom 2023-03-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014098.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0811-1 vom 2023-03-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014099.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:0821-1 vom 2023-03-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-March/014097.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:3642 vom 2023-06-15", "url": "https://access.redhat.com/errata/RHSA-2023:3642" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-144/index.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:6420 vom 2023-11-07", "url": "https://access.redhat.com/errata/RHSA-2023:6420" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0191-1 vom 2024-01-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017744.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2024:0196-1 vom 2024-01-23", "url": "https://lists.suse.com/pipermail/sle-security-updates/2024-January/017743.html" } ], "source_lang": "en-US", "title": "Grafana: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-01-23T23:00:00.000+00:00", "generator": { "date": "2024-02-15T17:11:46.152+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-0202", "initial_release_date": "2023-01-25T23:00:00.000+00:00", "revision_history": [ { "date": "2023-01-25T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-03-20T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2023-06-15T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-10-03T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2023-11-07T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-23T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" } ], "status": "final", "version": "6" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Hitachi Ops Center \u003c Analyzer 10.9.3-00", "product": { "name": "Hitachi Ops Center \u003c Analyzer 10.9.3-00", "product_id": "T030196", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:analyzer_10.9.3-00" } } }, { "category": "product_name", "name": "Hitachi Ops Center \u003c Viewpoint 10.9.3-00", "product": { "name": "Hitachi Ops Center \u003c Viewpoint 10.9.3-00", "product_id": "T030197", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:viewpoint_10.9.3-00" } } } ], "category": "product_name", "name": "Ops Center" } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Open Source Grafana \u003c 9.3.4", "product": { "name": "Open Source Grafana \u003c 9.3.4", "product_id": "T026031", "product_identification_helper": { "cpe": "cpe:/a:grafana:grafana:9.3.4" } } }, { "category": "product_name", "name": "Open Source Grafana \u003c 9.2.10", "product": { "name": "Open Source Grafana \u003c 9.2.10", "product_id": "T026032", "product_identification_helper": { "cpe": "cpe:/a:grafana:grafana:9.2.10" } } } ], "category": "product_name", "name": "Grafana" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-23552", "notes": [ { "category": "description", "text": "In Grafana existiert eine Cross-Site Scripting Schwachstelle. HTML und Script-Eingaben werden in ResourcePicker nicht ordnungsgem\u00e4\u00df \u00fcberpr\u00fcft, bevor sie an den Benutzer zur\u00fcckgegeben werden. Ein entfernter, authentisierter Angreifer kann durch Ausnutzung dieser Schwachstelle beliebigen HTML- und Script-Code durch den Browser des Benutzers im Kontext der betroffenen Seite ausf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich." } ], "product_status": { "known_affected": [ "T002207", "67646", "T030196", "T030197" ] }, "release_date": "2023-01-25T23:00:00Z", "title": "CVE-2022-23552" }, { "cve": "CVE-2022-39324", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Grafana. Der Fehler besteht in der Snapshot-Funktionalit\u00e4t aufgrund einer unsachgem\u00e4\u00dfen Behandlung des Werts des Parameters originalUrl. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Informationen falsch darzustellen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T002207", "67646", "T030196", "T030197" ] }, "release_date": "2023-01-25T23:00:00Z", "title": "CVE-2022-39324" }, { "cve": "CVE-2022-41912", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in Grafana. Der Fehler besteht aufgrund von nicht ordnungsgem\u00e4\u00df gepr\u00fcften SAML-Antworten. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, indem er SAML-Antworten abf\u00e4ngt und eine beliebige unsignierte Assertion hinzuf\u00fcgt, um seine Berechtigungen zu erweitern. Die Schwachstelle kann nur ausgenutzt werden, wenn ein SAML-Dokument nicht signiert ist und mehrere Assertions verwendet werden, wobei mindestens eine Assertion signiert ist." } ], "product_status": { "known_affected": [ "T002207", "67646", "T030196", "T030197" ] }, "release_date": "2023-01-25T23:00:00Z", "title": "CVE-2022-41912" } ] }
gsd-2022-23552
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2022-23552", "id": "GSD-2022-23552", "references": [ "https://www.suse.com/security/cve/CVE-2022-23552.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-23552" ], "details": "Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.", "id": "GSD-2022-23552", "modified": "2023-12-13T01:19:34.875623Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-23552", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "grafana", "version": { "version_data": [ { "version_affected": "=", "version_value": "\u003e= 9.0, \u003c 9.2.10" }, { "version_affected": "=", "version_value": "\u003e= 9.3, \u003c 9.3.4" }, { "version_affected": "=", "version_value": "\u003e= 8.1, \u003c 8.5.16" } ] } } ] }, "vendor_name": "grafana" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix." } ] }, "impact": { "cvss": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "cweId": "CWE-79", "lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv", "refsource": "MISC", "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv" }, { "name": "https://github.com/grafana/grafana/pull/62143", "refsource": "MISC", "url": "https://github.com/grafana/grafana/pull/62143" }, { "name": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0", "refsource": "MISC", "url": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0" }, { "name": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f", "refsource": "MISC", "url": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f" }, { "name": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a", "refsource": "MISC", "url": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a" } ] }, "source": { "advisory": "GHSA-8xmm-x63g-f6xv", "discovery": "UNKNOWN" } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "8.5.16", "versionStartIncluding": "8.1.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.2.10", "versionStartIncluding": "9.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.3.4", "versionStartIncluding": "9.3.0", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-23552" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-79" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0" }, { "name": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv" }, { "name": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f" }, { "name": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a" }, { "name": "https://github.com/grafana/grafana/pull/62143", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/grafana/grafana/pull/62143" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.3, "impactScore": 2.7 } }, "lastModifiedDate": "2023-02-07T19:57Z", "publishedDate": "2023-01-27T23:15Z" } } }
rhsa-2023_6420
Vulnerability from csaf_redhat
Published
2023-11-07 08:59
Modified
2024-11-24 20:52
Summary
Red Hat Security Advisory: grafana security and enhancement update
Notes
Topic
An update for grafana is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: persistent xss in grafana core plugins (CVE-2022-23552)
* grafana: plugin signature bypass (CVE-2022-31123)
* grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)
* grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201)
* grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)
* grafana: User enumeration via forget password (CVE-2022-39307)
* grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)
* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for grafana is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* grafana: persistent xss in grafana core plugins (CVE-2022-23552)\n\n* grafana: plugin signature bypass (CVE-2022-31123)\n\n* grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)\n\n* grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201)\n\n* grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)\n\n* grafana: User enumeration via forget password (CVE-2022-39307)\n\n* grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)\n\n* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)\n\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:6420", "url": "https://access.redhat.com/errata/RHSA-2023:6420" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index" }, { "category": "external", "summary": "2131146", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131146" }, { "category": "external", "summary": "2131147", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131147" }, { "category": "external", "summary": "2131148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131148" }, { "category": "external", "summary": "2138014", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138014" }, { "category": "external", "summary": "2138015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138015" }, { "category": "external", "summary": "2148252", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148252" }, { "category": "external", "summary": "2158420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158420" }, { "category": "external", "summary": "2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "2184483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184483" }, { "category": "external", "summary": "2188193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188193" }, { "category": "external", "summary": "2193018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2193018" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6420.json" } ], "title": "Red Hat Security Advisory: grafana security and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:52:38+00:00", "generator": { "date": "2024-11-24T20:52:38+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2023:6420", "initial_release_date": "2023-11-07T08:59:06+00:00", "revision_history": [ { "date": "2023-11-07T08:59:06+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-11-07T08:59:06+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:52:38+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "grafana-0:9.2.10-7.el9_3.src", "product": { "name": "grafana-0:9.2.10-7.el9_3.src", "product_id": "grafana-0:9.2.10-7.el9_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana@9.2.10-7.el9_3?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "grafana-0:9.2.10-7.el9_3.aarch64", "product": { "name": "grafana-0:9.2.10-7.el9_3.aarch64", "product_id": "grafana-0:9.2.10-7.el9_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana@9.2.10-7.el9_3?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "product": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "product_id": "grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-7.el9_3?arch=aarch64" } } }, { "category": "product_version", "name": "grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "product": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "product_id": "grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-7.el9_3?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "grafana-0:9.2.10-7.el9_3.ppc64le", "product": { "name": "grafana-0:9.2.10-7.el9_3.ppc64le", "product_id": "grafana-0:9.2.10-7.el9_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana@9.2.10-7.el9_3?arch=ppc64le" } } }, { "category": "product_version", "name": "grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "product": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "product_id": "grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-7.el9_3?arch=ppc64le" } } }, { "category": "product_version", "name": "grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "product": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "product_id": "grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-7.el9_3?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "grafana-0:9.2.10-7.el9_3.x86_64", "product": { "name": "grafana-0:9.2.10-7.el9_3.x86_64", "product_id": "grafana-0:9.2.10-7.el9_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana@9.2.10-7.el9_3?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-debugsource-0:9.2.10-7.el9_3.x86_64", "product": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.x86_64", "product_id": "grafana-debugsource-0:9.2.10-7.el9_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-7.el9_3?arch=x86_64" } } }, { "category": "product_version", "name": "grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "product": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "product_id": "grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-7.el9_3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "grafana-0:9.2.10-7.el9_3.s390x", "product": { "name": "grafana-0:9.2.10-7.el9_3.s390x", "product_id": "grafana-0:9.2.10-7.el9_3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana@9.2.10-7.el9_3?arch=s390x" } } }, { "category": "product_version", "name": "grafana-debugsource-0:9.2.10-7.el9_3.s390x", "product": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.s390x", "product_id": "grafana-debugsource-0:9.2.10-7.el9_3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-7.el9_3?arch=s390x" } } }, { "category": "product_version", "name": "grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "product": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "product_id": "grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-7.el9_3?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "grafana-0:9.2.10-7.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64" }, "product_reference": "grafana-0:9.2.10-7.el9_3.aarch64", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:9.2.10-7.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le" }, "product_reference": "grafana-0:9.2.10-7.el9_3.ppc64le", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:9.2.10-7.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x" }, "product_reference": "grafana-0:9.2.10-7.el9_3.s390x", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:9.2.10-7.el9_3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src" }, "product_reference": "grafana-0:9.2.10-7.el9_3.src", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-0:9.2.10-7.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64" }, "product_reference": "grafana-0:9.2.10-7.el9_3.x86_64", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64" }, "product_reference": "grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le" }, "product_reference": "grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x" }, "product_reference": "grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debuginfo-0:9.2.10-7.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64" }, "product_reference": "grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64" }, "product_reference": "grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le" }, "product_reference": "grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x" }, "product_reference": "grafana-debugsource-0:9.2.10-7.el9_3.s390x", "relates_to_product_reference": "AppStream-9.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "grafana-debugsource-0:9.2.10-7.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)", "product_id": "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" }, "product_reference": "grafana-debugsource-0:9.2.10-7.el9_3.x86_64", "relates_to_product_reference": "AppStream-9.3.0.GA" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Grafana Security Team" ] } ], "cve": "CVE-2022-23552", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2023-01-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158420" } ], "notes": [ { "category": "description", "text": "A flaw was found in The GeoMap and Canvas plugins of Grafana. The GeoMap and Canvas plugins are core plugins in Grafana, which means that all Grafana instances have GeoMap and Canvas installed. These two plugins are vulnerable to Cross-site scripting, where an attacker with an Editor role can add an SVG file containing malicious JavaScript code. The Javascript is executed when a user with an admin role later edits the GeoMap/Canvas panel.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: persistent xss in grafana core plugins", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-23552" }, { "category": "external", "summary": "RHBZ#2158420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158420" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23552", "url": "https://www.cve.org/CVERecord?id=CVE-2022-23552" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23552", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23552" }, { "category": "external", "summary": "https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/", "url": "https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/" } ], "release_date": "2023-01-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: persistent xss in grafana core plugins" }, { "cve": "CVE-2022-31123", "discovery_date": "2022-09-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2131147" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Grafana web application, where it is possible to install plugins which are not digitally signed. An admin could install unsigned plugins, which may contain malicious code.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: plugin signature bypass", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31123" }, { "category": "external", "summary": "RHBZ#2131147", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131147" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31123", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31123" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31123", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31123" }, { "category": "external", "summary": "https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8", "url": "https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8" } ], "release_date": "2022-10-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: plugin signature bypass" }, { "cve": "CVE-2022-31130", "discovery_date": "2022-09-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2131146" } ], "notes": [ { "category": "description", "text": "A flaw was found in Grafana\u0027s use of the GitLab data source plugin, leaking the API key to gitlab. This can result in the destination plugin receiving a Grafana user\u0027s authentication token, which could be used by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31130" }, { "category": "external", "summary": "RHBZ#2131146", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131146" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31130", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31130" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31130", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31130" } ], "release_date": "2022-10-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins" }, { "cve": "CVE-2022-39201", "discovery_date": "2022-09-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2131148" } ], "notes": [ { "category": "description", "text": "A flaw was found in Grafana. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. Grafana could leak the authentication cookie of users to plugins, which could result in an impact to confidentiality, integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39201" }, { "category": "external", "summary": "RHBZ#2131148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2131148" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39201", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39201" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39201", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39201" } ], "release_date": "2022-10-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins" }, { "acknowledgments": [ { "names": [ "Grafana Team" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-39306", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2022-10-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2138014" } ], "notes": [ { "category": "description", "text": "An authentication bypass flaw was discovered in Grafana. This issue could allow a remote unauthenticated attacker to create an account and provide access to a certain organization, which can be exploited by gaining access to the signup link. The highest impacts to the system are confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: email addresses and usernames cannot be trusted", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39306" }, { "category": "external", "summary": "RHBZ#2138014", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138014" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39306", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39306" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39306", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39306" }, { "category": "external", "summary": "https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/", "url": "https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/" } ], "release_date": "2022-11-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: email addresses and usernames cannot be trusted" }, { "acknowledgments": [ { "names": [ "Grafana Team" ] } ], "cve": "CVE-2022-39307", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2022-10-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2138015" } ], "notes": [ { "category": "description", "text": "An information leak was discovered in Grafana. Remote unauthenticated users could exploit the forget password feature to discover which user accounts exist.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: User enumeration via forget password", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39307" }, { "category": "external", "summary": "RHBZ#2138015", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138015" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39307", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39307" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39307", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39307" }, { "category": "external", "summary": "https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/", "url": "https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/" } ], "release_date": "2022-11-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: User enumeration via forget password" }, { "acknowledgments": [ { "names": [ "Grafana Security Team" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2022-39324", "cwe": { "id": "CWE-472", "name": "External Control of Assumed-Immutable Web Parameter" }, "discovery_date": "2022-11-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148252" } ], "notes": [ { "category": "description", "text": "A flaw was found in the grafana package. While creating a snapshot, an attacker may manipulate a hidden HTTP parameter to inject a malicious URL in the \"Open original dashboard\" button.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: Spoofing of the originalUrl parameter of snapshots", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Service Mesh containers include the Grafana RPM from RHEL and consume CVE fixes for Grafana from RHEL channels. The servicemesh-grafana RPM shipped in early versions of OpenShift Service Mesh 2.1 is no longer maintained.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-39324" }, { "category": "external", "summary": "RHBZ#2148252", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148252" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-39324", "url": "https://www.cve.org/CVERecord?id=CVE-2022-39324" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-39324", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39324" }, { "category": "external", "summary": "https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/", "url": "https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/" } ], "release_date": "2023-01-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "grafana: Spoofing of the originalUrl parameter of snapshots" }, { "cve": "CVE-2022-41717", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2023-01-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2161274" } ], "notes": [ { "category": "description", "text": "A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests", "title": "Vulnerability summary" }, { "category": "other", "text": "Within Red Hat OpenShift Container Platform, the grafana container is listed as will not fix. Since OCP 4.10, Grafana itself is not shipped and the Grafana web server is protected behind an OAuth proxy server.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-41717" }, { "category": "external", "summary": "RHBZ#2161274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2161274" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-41717", "url": "https://www.cve.org/CVERecord?id=CVE-2022-41717" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41717" }, { "category": "external", "summary": "https://go.dev/cl/455635", "url": "https://go.dev/cl/455635" }, { "category": "external", "summary": "https://go.dev/cl/455717", "url": "https://go.dev/cl/455717" }, { "category": "external", "summary": "https://go.dev/issue/56350", "url": "https://go.dev/issue/56350" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ", "url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2022-1144", "url": "https://pkg.go.dev/vuln/GO-2022-1144" } ], "release_date": "2022-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests" }, { "cve": "CVE-2023-24534", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-04-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2184483" } ], "notes": [ { "category": "description", "text": "A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by memory exhaustion in the common function in HTTP and MIME header parsing. By sending a specially crafted request, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http, net/textproto: denial of service from excessive memory allocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-24534" }, { "category": "external", "summary": "RHBZ#2184483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2184483" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-24534", "url": "https://www.cve.org/CVERecord?id=CVE-2023-24534" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24534" }, { "category": "external", "summary": "https://go.dev/issue/58975", "url": "https://go.dev/issue/58975" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8" } ], "release_date": "2023-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-11-07T08:59:06+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:6420" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.src", "AppStream-9.3.0.GA:grafana-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debuginfo-0:9.2.10-7.el9_3.x86_64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.aarch64", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.ppc64le", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.s390x", "AppStream-9.3.0.GA:grafana-debugsource-0:9.2.10-7.el9_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http, net/textproto: denial of service from excessive memory allocation" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.