Multiple vulnerabilities in Grafana



Published: 2022-07-15 | Updated: 2022-07-27
Risk High
Patch available YES
Number of vulnerabilities 7
CVE-ID CVE-2022-31107
CVE-2022-31097
CVE-2020-7753
CVE-2021-3807
CVE-2021-3918
CVE-2021-43138
CVE-2022-0155
CWE-ID CWE-287
CWE-79
CWE-185
CWE-20
CWE-94
CWE-200
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Grafana
Web applications / Other software

Vendor Grafana Labs

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Improper Authentication

EUVDB-ID: #VU65353

Risk: High

CVSSv3.1:

CVE-ID: CVE-2022-31107

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in OAuth implementation routine. A remote attacker can bypass authentication process and login under arbitrary account.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2, 8.5.0 - 8.5.6, 8.4.0 - 8.4.7, 8.3.0 - 8.3.7, 8.2.0 - 8.2.7, 8.1.0 - 8.1.8, 8.0.0 - 8.0.7

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v8.4.10
http://github.com/grafana/grafana/releases/tag/v9.0.3
http://github.com/grafana/grafana/releases/tag/v8.5.9
http://github.com/grafana/grafana/releases/tag/v8.3.10
http://github.com/grafana/grafana/pull/52279
http://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Stored cross-site scripting

EUVDB-ID: #VU65354

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-31097

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2, 8.5.0 - 8.5.5, 8.4.0 - 8.4.7, 8.3.0 - 8.3.7, 8.2.0 - 8.2.7, 8.1.0 - 8.1.8, 8.0.0 - 8.0.7

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v8.4.10
http://github.com/grafana/grafana/pull/52279
http://github.com/grafana/grafana/releases/tag/v9.0.3
http://github.com/grafana/grafana/releases/tag/v8.3.10
http://github.com/grafana/grafana/releases/tag/v8.5.9
http://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Incorrect Regular Expression

EUVDB-ID: #VU65355

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-7753

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v9.0.3


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Input validation error

EUVDB-ID: #VU57967

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-3807

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when matching crafted invalid ANSI escape codes in ansi-regex. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v9.0.3


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Code Injection

EUVDB-ID: #VU64034

Risk: High

CVSSv3.1:

CVE-ID: CVE-2021-3918

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data during the validation of a JSON object. A remote attacker can pass a specially crafted JSON file for validation and execute arbitrary code.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v9.0.3


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Prototype pollution

EUVDB-ID: #VU62361

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-43138

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges within the application.

The vulnerability exists due to improper input validation when handling data passed via the mapValues() method. A remote attacker can send a specially crafted request and escalate privileges within the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v9.0.3


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Information disclosure

EUVDB-ID: #VU61669

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-0155

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.2

CPE2.3 External links

http://github.com/grafana/grafana/releases/tag/v9.0.3


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###