Cross-site request forgery in Grafana - CVE-2022-21703

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU64399

Cross-site request forgery in Grafana - CVE-2022-21703

Published: June 15, 2022


Vulnerability identifier: #VU64399
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-21703
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability: No public exploit available
Affected software:
Grafana
Oracle Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud
Red Hat Enterprise Linux for ARM 64
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
Fedora
ObjectScale
IBM Watson Machine Learning Accelerator
Storage Ceph
OpenShift Service Mesh
SUSE Linux Enterprise Module for Packagehub Subpackages
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
golang-github-prometheus-alertmanager
system-user-prometheus
system-user-grafana
golang-github-lusitaniae-apache_exporter
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
python2-hwdata
golang-github-prometheus-prometheus
python3-mgr-virtualization-host
mgr-virtualization-host
python3-mgr-virtualization-common
python3-spacewalk-oscap
spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
python3-mgr-cfg-management
mgr-cfg
mgr-cfg-actions
mgr-cfg-client
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-osad
python3-mgr-osa-common
mgr-osad
spacecmd
spacewalk-client-setup
python3-spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-check
supportutils-plugin-susemanager-client
mgr-custom-info
spacewalk-remote-utils
python2-suseRegisterInfo
python2-uyuni-common-libs
python2-mgr-push
mgr-daemon
python2-rhnlib
python2-mgr-virtualization-host
python2-mgr-virtualization-common
python2-spacewalk-oscap
python2-spacewalk-koan
python2-mgr-cfg-client
python2-mgr-cfg-management
python2-mgr-cfg
python2-mgr-cfg-actions
python2-mgr-osad
python2-mgr-osa-common
python2-spacewalk-client-setup
python2-spacewalk-client-tools
python2-spacewalk-check
grafana
grafana-debuginfo
grafana (Red Hat package)

Detailed vulnerability description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim into inviting the attacker as a new user with high privileges to escalate privileges.


How to mitigate CVE-2022-21703

Install updates from vendor's website.

Sources