Skip to content
OpenAdvisories
Medium ALSA-2023:6420 9 CVEs

Moderate: grafana security and enhancement update

Published Nov 7, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: persistent xss in grafana core plugins (CVE-2022-23552)
* grafana: plugin signature bypass (CVE-2022-31123)
* grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)
* grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201)
* grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)
* grafana: User enumeration via forget password (CVE-2022-39307)
* grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)
* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 grafana 9.2.10-7.el9_3.alma.1

Vulnerabilities 9

  • High 7.5
    CVE-2023-24534

    Excessive memory allocation in net/http and net/textproto

    HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

    Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2022-23552

    Grafana stored XSS in FileUploader component

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possib…

    Grafana Grafana Web / CMS
  • Medium 6.8
    CVE-2022-39201

    Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

    Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plug…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.7
    CVE-2022-39307

    Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

    Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.7
    CVE-2022-39324

    Grafana vulnerable to spoofing originalUrl of snapshots

    Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user ope…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.4
    CVE-2022-39306

    Grafana contains Improper Input Validation

    Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.1
    CVE-2022-31123

    Grafana plugin signature bypass vulnerability

    Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious p…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.9
    CVE-2022-31130

    Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

    Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and …

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-23552
  • report
    https://access.redhat.com/security/cve/CVE-2022-31123
  • report
    https://access.redhat.com/security/cve/CVE-2022-31130
  • report
    https://access.redhat.com/security/cve/CVE-2022-39201
  • report
    https://access.redhat.com/security/cve/CVE-2022-39306
  • report
    https://access.redhat.com/security/cve/CVE-2022-39307
  • report
    https://access.redhat.com/security/cve/CVE-2022-39324
  • report
    https://access.redhat.com/security/cve/CVE-2022-41717
  • report
    https://access.redhat.com/security/cve/CVE-2023-24534
  • report
    https://bugzilla.redhat.com/2131146
  • report
    https://bugzilla.redhat.com/2131147
  • report
    https://bugzilla.redhat.com/2131148
  • report
    https://bugzilla.redhat.com/2138014
  • report
    https://bugzilla.redhat.com/2138015
  • report
    https://bugzilla.redhat.com/2148252
  • report
    https://bugzilla.redhat.com/2158420
  • report
    https://bugzilla.redhat.com/2161274
  • report
    https://bugzilla.redhat.com/2184483
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-6420.html