Red Hat Security Advisory

RHSA-2023:6420

grafana security and enhancement update

Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-7.el9_3

Fixes 11 records

TI-2023-02931 CVE-2023-3128 · GHSA-mpv3-g8m3-3fjc

Authentication bypass by spoofing in Grafana

HIGH 82

Grafana is validating Azure AD accounts based on the email claim.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03995 Published 2023-06-22 Partial fix · 9.5.4, 9.4.13 +3 CWE-290

TI-2022-17515 CVE-2022-37601 · GHSA-76p3-8jx3-jpfq

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack…

HIGH 82

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03503 Published 2022-10-12 Partial fix · 2.0.3, 1.4.1 CWE-1321

TI-2022-18682 CVE-2022-39306 · GHSA-2x6g-h2hg-rq84

Grafana contains Improper Input Validation

LOW 39

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00895 Published 2022-11-09 Partial fix · 8.5.15, 9.2.4 CWE-20

TI-2022-18581 CVE-2022-39201 · GHSA-x744-mm8v-vpgr

Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

LOW 38

Grafana is an open source observability and data visualization platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01673 Published 2022-10-13 Partial fix · 8.5.14, 9.1.8 CWE-200

TI-2023-10155 CVE-2023-24534 · GHSA-8v5j-pwr7-w5f8

Excessive memory allocation in net/http and net/textproto

LOW 37

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01888 Published 2023-04-06 Partial fix · 1.19.8, 1.20.3 CWE-400

TI-2022-13174 CVE-2022-31130 · GHSA-jv32-5578-pxjc

Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

LOW 36

Grafana is an open source observability and data visualization platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01334 Published 2022-10-13 Partial fix · 8.5.14, 9.1.8 CWE-200

TI-2022-13167 CVE-2022-31123 · GHSA-rhxj-gh46-jvw8

Grafana plugin signature bypass vulnerability

LOW 36

Grafana is an open source observability and data visualization platform.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00275 Published 2022-10-13 Partial fix · 8.5.14, 9.1.8 CWE-347

TI-2022-07605 CVE-2022-23552

Grafana stored XSS in FileUploader component

LOW 36

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00815 Published 2023-01-27 Fixed in 9.2.10, 9.3.4 +1 CWE-79

TI-2022-20109 CVE-2022-41717 · GHSA-xrjj-mj9h-534m

Excessive memory growth in net/http and golang.org/x/net/http2

LOW 33

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06077 Published 2022-12-08 Partial fix · 1.18.9, 1.19.4 +1 CWE-770

TI-2022-18700 CVE-2022-39324 · GHSA-4724-7jwc-3fpw

Grafana vulnerable to spoofing originalUrl of snapshots

LOW 33

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00866 Published 2023-01-27 Partial fix · 8.5.16, 9.2.8 CWE-79

TI-2022-18683 CVE-2022-39307 · GHSA-3p62-42x7-gxg5

Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

LOW 33

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.7 Network Low privileges User interaction EPSS 0.00874 Published 2022-11-09 Partial fix · 9.2.4, 8.5.15 CWE-200