Skip to content
OpenAdvisories
High WID-SEC-2023-0334 3 CVEs

Grafana: Mehrere Schwachstellen

Published Nov 8, 2022 · Updated Jan 23, 2024 · Revision 6 · de-DE

Vendor: Grafana Vendor: Hitachi Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Grafana Product: Linux Product: Open Source Grafana < 8.5.15 Product: Open Source Grafana < 9.2.4 Product: Ops Center Product: Ops Center < Analyzer 10.9.3-00 Product: Ops Center < Viewpoint 10.9.3-00 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um Benutzerrechte zu erlangen, seine Privilegien zu erweitern und um Informationen offenzulegen.

Product

Grafana ist eine Open-Source Analyse- und Visualisierungssoftware.

Vulnerabilities 3

  • Critical 9.8
    CVE-2022-39328

    Grafana vulnerable to race condition allowing privilege escalation

    Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint …

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.7
    CVE-2022-39307

    Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

    Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 6.4
    CVE-2022-39306

    Grafana contains Improper Input Validation

    Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

Revision history

  1. #6

    Neue Updates von SUSE aufgenommen

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von HITACHI aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    Neue Updates von SUSE aufgenommen

  6. #1

    Initiale Fassung

References