Skip to content
OpenAdvisories
Medium WID-SEC-2022-1702 4 CVEs

Grafana: Mehrere Schwachstellen

Published Oct 12, 2022 · Updated Jan 23, 2024 · Revision 8 · de-DE

Vendor: Grafana Vendor: Hitachi Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Grafana Product: Linux Product: Linux Product: Open Source Grafana < 8.5.14 Product: Open Source Grafana < 9.1.8 Product: Open Source Grafana < 9.2 Product: Ops Center Product: Ops Center < Analyzer 10.9.3-00 Product: Ops Center < Viewpoint 10.9.3-00 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.

Vulnerabilities 4

  • Medium 6.8
    CVE-2022-39201

    Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

    Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plug…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.1
    CVE-2022-31123

    Grafana plugin signature bypass vulnerability

    Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious p…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 4.9
    CVE-2022-31130

    Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

    Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and …

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 4.3
    CVE-2022-39229

    Grafana users with email as a username can block other users from signing in

    Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username a…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

Revision history

  1. #8

    Neue Updates von SUSE aufgenommen

  2. #7

    Neue Updates von HITACHI aufgenommen

  3. #6

    Neue Updates von Red Hat aufgenommen

  4. #5

    Neue Updates von Oracle Linux aufgenommen

  5. #4

    Neue Updates von Red Hat aufgenommen

  6. #3

    Neue Updates von Red Hat aufgenommen

  7. #2

    Neue Updates von SUSE aufgenommen

  8. #1

    Initiale Fassung

References