Skip to content
OpenAdvisories
High WID-SEC-2023-0202 3 CVEs

Grafana: Mehrere Schwachstellen

Published Jan 25, 2023 · Updated Jan 23, 2024 · Revision 6 · de-DE

Vendor: Grafana Vendor: Hitachi Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Grafana Product: Linux Product: Open Source Grafana < 9.2.10 Product: Open Source Grafana < 9.3.4 Product: Ops Center Product: Ops Center < Analyzer 10.9.3-00 Product: Ops Center < Viewpoint 10.9.3-00 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen falsch darzustellen und seine Privilegien zu erweitern.

Product

Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.

Vulnerabilities 3

  • Critical 9.1
    CVE-2022-41912

    crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

    The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading t…

    crewjam saml github.com/crewjam/saml golang-github-crewjam-saml Ubuntu Go
  • High 7.3
    CVE-2022-23552

    Grafana stored XSS in FileUploader component

    Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possib…

    Grafana Grafana Web / CMS
  • Medium 6.7
    CVE-2022-39324

    Grafana vulnerable to spoofing originalUrl of snapshots

    Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user ope…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von HITACHI aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References