Cross-site scripting in Grafana - CVE-2022-21702

Vulnerability identifier: #VU64397

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2022-21702

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in Grafana. A remote attacker can trick the victim to visit a specially crafted link, execute arbitrary HTML code, and perform a Cross-site scripting (XSS) attack.

Grafana
Oracle Linux
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
IBM Watson Machine Learning Accelerator
Storage Ceph
OpenShift Service Mesh
SUSE Linux Enterprise Module for Packagehub Subpackages
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
golang-github-prometheus-alertmanager
system-user-prometheus
system-user-grafana
golang-github-lusitaniae-apache_exporter
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
python2-hwdata
golang-github-prometheus-prometheus
mgr-virtualization-host
python3-mgr-virtualization-host
python3-mgr-virtualization-common
spacewalk-oscap
python3-spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
mgr-cfg-actions
mgr-cfg
mgr-cfg-client
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-cfg-management
python3-mgr-osad
python3-mgr-osa-common
mgr-osad
spacecmd
spacewalk-check
spacewalk-client-tools
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-client-setup
supportutils-plugin-susemanager-client
mgr-custom-info
spacewalk-remote-utils
python2-suseRegisterInfo
python2-uyuni-common-libs
python2-mgr-push
mgr-daemon
python2-rhnlib
python2-mgr-virtualization-host
python2-mgr-virtualization-common
python2-spacewalk-oscap
python2-spacewalk-koan
python2-mgr-cfg-management
python2-mgr-cfg-client
python2-mgr-cfg-actions
python2-mgr-cfg
python2-mgr-osad
python2-mgr-osa-common
python2-spacewalk-check
python2-spacewalk-client-setup
python2-spacewalk-client-tools
grafana
grafana-debuginfo
grafana (Red Hat package)

Install updates from vendor's website.

Grafana - addressed in versions 7.5.15, 8.3.5
IBM Watson Machine Learning Accelerator - update to 3.0.0
OpenShift Service Mesh - update to 2.3.1
kiwi-desc-saltboot - update to 0.1.1687520761.cefb248-4.15.2
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-1.6.1, 0.4.0-4.6.2
prometheus-postgres_exporter - addressed in versions 0.10.0-1.8.2, 0.10.0-150000.1.3.1, 0.10.1-3.6.4
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-1.12.3, 0.26.0-4.12.4
system-user-prometheus - update to 1.0.0-3.7.2
system-user-grafana - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - update to 1.0.0-4.12.4
supportutils-plugin-salt - addressed in versions 1.2.0-6.16.1, 1.2.2-9.9.2
golang-github-prometheus-node_exporter - addressed in versions 1.3.0-1.15.3, 1.5.0-4.15.4
golang-github-boynux-squid_exporter - update to 1.6-4.9.2
python2-hwdata - addressed in versions 2.3.5-12.9.1, 2.3.5-15.12.2
golang-github-prometheus-prometheus - update to 2.45.0-4.33.3
mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.5-1.29.3
python3-mgr-virtualization-host - update to 4.2.4-150000.1.26.1
python3-mgr-virtualization-common - update to 4.2.4-150000.1.26.1
spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.5-19.27.1
python3-spacewalk-oscap - update to 4.2.4-150000.3.18.1
python3-mgr-push - update to 4.2.5-150000.1.18.2
mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.4-1.21.4, 5.0.1-4.21.4
python3-suseRegisterInfo - update to 4.2.6-150000.3.21.1
suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.3-25.27.3
python3-spacewalk-koan - update to 4.2.6-150000.3.27.1
spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.5-24.33.3
python3-rhnlib - update to 4.2.6-150000.3.34.1
mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
python3-mgr-cfg - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-actions - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-client - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-management - update to 4.2.8-150000.1.24.1
python3-mgr-osad - update to 4.2.8-150000.1.36.1
python3-mgr-osa-common - update to 4.2.8-150000.1.36.1
mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.6-1.39.4
spacecmd - addressed in versions 4.2.16-150000.3.77.1, 4.3.11-38.103.3, 5.0.1-41.42.3
spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
python3-spacewalk-check - update to 4.2.18-150000.3.59.1
python3-spacewalk-client-setup - update to 4.2.18-150000.3.59.1
python3-spacewalk-client-tools - update to 4.2.18-150000.3.59.1
spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
supportutils-plugin-susemanager-client - addressed in versions 4.3.2-6.24.1, 5.0.1-9.15.2
mgr-custom-info - update to 4.3.3-1.18.1
spacewalk-remote-utils - update to 4.3.3-24.24.3
python2-suseRegisterInfo - update to 4.3.3-25.27.3
python2-uyuni-common-libs - addressed in versions 4.3.4-1.21.3, 5.0.1-3.33.3
python2-mgr-push - addressed in versions 4.3.4-1.21.4, 5.0.1-4.21.4
mgr-daemon - update to 4.3.4-1.32.3
python2-rhnlib - addressed in versions 4.3.4-21.43.3, 5.0.1-24.30.3
python2-mgr-virtualization-host - update to 4.3.5-1.29.3
python2-mgr-virtualization-common - update to 4.3.5-1.29.3
python2-spacewalk-oscap - update to 4.3.5-19.27.1
python2-spacewalk-koan - update to 4.3.5-24.33.3
python2-mgr-cfg-management - update to 4.3.6-1.27.4
python2-mgr-cfg-client - update to 4.3.6-1.27.4
python2-mgr-cfg-actions - update to 4.3.6-1.27.4
python2-mgr-cfg - update to 4.3.6-1.27.4
python2-mgr-osad - update to 4.3.6-1.39.4
python2-mgr-osa-common - update to 4.3.6-1.39.4
python2-spacewalk-check - update to 4.3.9-52.71.3
python2-spacewalk-client-setup - update to 4.3.9-52.71.3
python2-spacewalk-client-tools - update to 4.3.9-52.71.3
Storage Ceph - update to 6.1
grafana - addressed in versions 7.5.11-4, 7.5.15-3
grafana-debuginfo - addressed in versions 7.5.11-4, 7.5.15-3
grafana - addressed in versions 7.5.15-2.fc34, 7.5.15-2.fc35, 7.5.15-2.fc36
grafana (Red Hat package) - addressed in versions 7.5.15-3.el8, 7.5.15-3.el9
grafana - addressed in versions 8.3.5-1.30.3, 8.3.5-150000.1.30.1, 8.3.10-150200.3.26.1, 8.5.13-150100.3.12.1, 9.5.8-4.21.2
grafana-debuginfo - addressed in versions 8.3.5-150000.1.30.1, 8.3.10-150200.3.26.1, 8.5.13-150100.3.12.1

• https://github.com/grafana/grafana/security/advisories/GHSA-xc3p-28hw-q24g
• https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
• https://github.com/grafana/grafana/commit/27726868b3d7c613844b55cd209ca93645c99b85
• https://bugzilla.redhat.com/show_bug.cgi?id=2050648

• Multiple vulnerabilities in Grafana
• SUSE update for SUSE Manager Client Tools
• SUSE update for grafana
• SUSE update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Oracle Linux
• Cross-site scripting in IBM Storage Ceph
• SUSE update for Security Beta update for SUSE Manager Client Tools
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for grafana
• openEuler 22.03 LTS update for grafana
• Fedora 36 update for grafana
• Fedora 35 update for grafana
• Fedora 34 update for grafana