Skip to content
OpenAdvisories
Critical RHSA-2023:6420 11 CVEs

Red Hat Security Advisory: grafana security and enhancement update

Published Sep 30, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana 0:9.2.10-7.el9_3
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debuginfo 0:9.2.10-7.el9_3
Red Hat · RHEL 9 enterprise_linux:9::appstream grafana-debugsource 0:9.2.10-7.el9_3

Vulnerabilities 11

  • Critical 9.8
    CVE-2022-37601

    Prototype pollution in webpack loader-utils

    Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

    reaper jitsucom-jitsu loader-utils node-loader-utils Debian Ubuntu Azure Linux Wolfi npm
  • Critical 9.4
    CVE-2023-3128 Public exploit

    Grafana vulnerable to Authentication Bypass by Spoofing

    Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

    Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  • High 7.5
    CVE-2023-24534

    Excessive memory allocation in net/http and net/textproto

    HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

    Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2022-23552

    Grafana stored XSS in FileUploader component

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possib…

    Grafana Grafana Web / CMS
  • Medium 6.8
    CVE-2022-39201

    Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

    Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plug…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.7
    CVE-2022-39307

    Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

    Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.7
    CVE-2022-39324

    Grafana vulnerable to spoofing originalUrl of snapshots

    Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user ope…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.4
    CVE-2022-39306

    Grafana contains Improper Input Validation

    Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.1
    CVE-2022-31123

    Grafana plugin signature bypass vulnerability

    Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious p…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.9
    CVE-2022-31130

    Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

    Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and …

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2131146
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2131147
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2131148
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2138014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2138015
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2148252
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2158420
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2161274
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2184483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2188193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2193018
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6420.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-23552
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-23552
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-23552
  • article
    https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/
  • report
    https://access.redhat.com/security/cve/CVE-2022-31123
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31123
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31123
  • article
    https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8
  • report
    https://access.redhat.com/security/cve/CVE-2022-31130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31130
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31130
  • report
    https://access.redhat.com/security/cve/CVE-2022-37601
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2134876
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-37601
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-37601
  • article
    https://github.com/webpack/loader-utils/issues/212
  • report
    https://access.redhat.com/security/cve/CVE-2022-39201
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-39201
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-39201
  • report
    https://access.redhat.com/security/cve/CVE-2022-39306
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-39306
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-39306
  • article
    https://grafana.com/blog/2022/11/08/security-release-new-versions-of-grafana-with-critical-and-moderate-fixes-for-cve-2022-39328-cve-2022-39307-and-cve-2022-39306/
  • report
    https://access.redhat.com/security/cve/CVE-2022-39307
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-39307