Authorization bypass through user-controlled key in Grafana - CVE-2022-21713

Vulnerability identifier: #VU64394

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21713

CWE-ID: CWE-639

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an Insecure Direct Object Reference (IDOR) error in Grafana Teams APIs. A remote authenticated user can view unintended data by querying for the specific team ID or search for teams and see the total number of available teams.

Grafana
Oracle Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud
Red Hat Enterprise Linux for ARM 64
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
ObjectScale
IBM Watson Machine Learning Accelerator
OpenShift Service Mesh
SUSE Linux Enterprise Module for Packagehub Subpackages
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
golang-github-prometheus-alertmanager
system-user-prometheus
system-user-grafana
golang-github-lusitaniae-apache_exporter
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
python2-hwdata
golang-github-prometheus-prometheus
python3-mgr-virtualization-host
mgr-virtualization-host
python3-mgr-virtualization-common
python3-spacewalk-oscap
spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
python3-mgr-cfg-management
mgr-cfg
mgr-cfg-actions
mgr-cfg-client
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-osad
python3-mgr-osa-common
mgr-osad
spacecmd
spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-check
supportutils-plugin-susemanager-client
mgr-custom-info
spacewalk-remote-utils
python2-suseRegisterInfo
python2-uyuni-common-libs
python2-mgr-push
mgr-daemon
python2-rhnlib
python2-mgr-virtualization-host
python2-mgr-virtualization-common
python2-spacewalk-oscap
python2-spacewalk-koan
python2-mgr-cfg-client
python2-mgr-cfg-management
python2-mgr-cfg-actions
python2-mgr-cfg
python2-mgr-osad
python2-mgr-osa-common
python2-spacewalk-check
python2-spacewalk-client-setup
python2-spacewalk-client-tools
grafana
grafana-debuginfo
grafana (Red Hat package)

Install updates from vendor's website.

Grafana - addressed in versions 7.5.15, 8.3.5
ObjectScale - update to 1.3.0
IBM Watson Machine Learning Accelerator - update to 3.0.0
OpenShift Service Mesh - update to 2.3.1
kiwi-desc-saltboot - update to 0.1.1687520761.cefb248-4.15.2
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-1.6.1, 0.4.0-4.6.2
prometheus-postgres_exporter - addressed in versions 0.10.0-1.8.2, 0.10.0-150000.1.3.1, 0.10.1-3.6.4
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-1.12.3, 0.26.0-4.12.4
system-user-prometheus - update to 1.0.0-3.7.2
system-user-grafana - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - update to 1.0.0-4.12.4
supportutils-plugin-salt - addressed in versions 1.2.0-6.16.1, 1.2.2-9.9.2
golang-github-prometheus-node_exporter - addressed in versions 1.3.0-1.15.3, 1.5.0-4.15.4
golang-github-boynux-squid_exporter - update to 1.6-4.9.2
python2-hwdata - addressed in versions 2.3.5-12.9.1, 2.3.5-15.12.2
golang-github-prometheus-prometheus - update to 2.45.0-4.33.3
python3-mgr-virtualization-host - update to 4.2.4-150000.1.26.1
mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.5-1.29.3
python3-mgr-virtualization-common - update to 4.2.4-150000.1.26.1
python3-spacewalk-oscap - update to 4.2.4-150000.3.18.1
spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.5-19.27.1
python3-mgr-push - update to 4.2.5-150000.1.18.2
mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.4-1.21.4, 5.0.1-4.21.4
python3-suseRegisterInfo - update to 4.2.6-150000.3.21.1
suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.3-25.27.3
python3-spacewalk-koan - update to 4.2.6-150000.3.27.1
spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.5-24.33.3
python3-rhnlib - update to 4.2.6-150000.3.34.1
python3-mgr-cfg-management - update to 4.2.8-150000.1.24.1
mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
python3-mgr-cfg - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-actions - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-client - update to 4.2.8-150000.1.24.1
python3-mgr-osad - update to 4.2.8-150000.1.36.1
python3-mgr-osa-common - update to 4.2.8-150000.1.36.1
mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.6-1.39.4
spacecmd - addressed in versions 4.2.16-150000.3.77.1, 4.3.11-38.103.3, 5.0.1-41.42.3
spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
python3-spacewalk-check - update to 4.2.18-150000.3.59.1
python3-spacewalk-client-setup - update to 4.2.18-150000.3.59.1
python3-spacewalk-client-tools - update to 4.2.18-150000.3.59.1
spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
supportutils-plugin-susemanager-client - addressed in versions 4.3.2-6.24.1, 5.0.1-9.15.2
mgr-custom-info - update to 4.3.3-1.18.1
spacewalk-remote-utils - update to 4.3.3-24.24.3
python2-suseRegisterInfo - update to 4.3.3-25.27.3
python2-uyuni-common-libs - addressed in versions 4.3.4-1.21.3, 5.0.1-3.33.3
python2-mgr-push - addressed in versions 4.3.4-1.21.4, 5.0.1-4.21.4
mgr-daemon - update to 4.3.4-1.32.3
python2-rhnlib - addressed in versions 4.3.4-21.43.3, 5.0.1-24.30.3
python2-mgr-virtualization-host - update to 4.3.5-1.29.3
python2-mgr-virtualization-common - update to 4.3.5-1.29.3
python2-spacewalk-oscap - update to 4.3.5-19.27.1
python2-spacewalk-koan - update to 4.3.5-24.33.3
python2-mgr-cfg-client - update to 4.3.6-1.27.4
python2-mgr-cfg-management - update to 4.3.6-1.27.4
python2-mgr-cfg-actions - update to 4.3.6-1.27.4
python2-mgr-cfg - update to 4.3.6-1.27.4
python2-mgr-osad - update to 4.3.6-1.39.4
python2-mgr-osa-common - update to 4.3.6-1.39.4
python2-spacewalk-check - update to 4.3.9-52.71.3
python2-spacewalk-client-setup - update to 4.3.9-52.71.3
python2-spacewalk-client-tools - update to 4.3.9-52.71.3
grafana - update to 7.5.15-1
grafana-debuginfo - update to 7.5.15-1
grafana - addressed in versions 7.5.15-2.fc34, 7.5.15-2.fc35, 7.5.15-2.fc36
grafana (Red Hat package) - addressed in versions 7.5.15-3.el8, 7.5.15-3.el9
grafana - addressed in versions 8.3.5-1.30.3, 8.3.5-150000.1.30.1, 8.3.10-150200.3.26.1, 8.5.13-150100.3.12.1, 9.5.8-4.21.2
grafana-debuginfo - addressed in versions 8.3.5-150000.1.30.1, 8.3.10-150200.3.26.1, 8.5.13-150100.3.12.1

• https://github.com/grafana/grafana/pull/45083
• https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
• https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv
• https://security.netapp.com/advisory/ntap-20220303-0005/
• https://bugzilla.redhat.com/show_bug.cgi?id=2050743

• Multiple vulnerabilities in Grafana
• SUSE update for SUSE Manager Client Tools
• SUSE update for grafana
• SUSE update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Oracle Linux
• SUSE update for Security Beta update for SUSE Manager Client Tools
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for grafana
• Fedora 36 update for grafana
• Fedora 35 update for grafana
• Fedora 34 update for grafana
• Multiple vulnerabilities in Dell ObjectScale