SB2023021201 - Multiple vulnerabilities in Grafana

Security Bulletin ID SB2023021201

Severity

Medium

Patch available

YES

Number of vulnerabilities 4

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2022-39229)

The vulnerability allows a remote attacker to deny access to the application.

The vulnerability exists due to a logic error in the authentication process, where application allows usage of the same email address by different accounts. A remote user can set an existing email address that belongs to another user as their username and prevent that user from accessing the application.

2) Information disclosure (CVE-ID: CVE-2022-39201)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to Grafana leaks the authentication cookie of users to plugins. A remote user can gain unauthorized access to sensitive information.

3) Information disclosure (CVE-ID: CVE-2022-31130)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the GitLab data source plugin leaks the API key to GitLab. A remote privileged user can expose Grafana authentication token to a third-party.

4) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2022-31123)

The vulnerability allows a remote attacker to compromise the affected instance.

The vulnerability exists due to missing signature verification mechanism. A remote attacker can trick the server admin into installing a malicious plugin even though unsigned plugins are not allowed.

Remediation

Install update from vendor's website.

SB2023021201 - Multiple vulnerabilities in Grafana

Breakdown by Severity

Description

Remediation

References