Information disclosure in Grafana - CVE-2022-21673

Vulnerability identifier: #VU64402

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-21673

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can pass a specially crafted query to the data source with an API token and Forward OAuth Identity feature enabled to gain unauthorized access to sensitive information on the system.

Grafana
Oracle Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fedora
IBM Watson Machine Learning Accelerator
OpenShift Service Mesh
Red Hat Ceph Storage
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter
prometheus-blackbox_exporter-debuginfo
golang-github-prometheus-alertmanager
system-user-prometheus
system-user-grafana
golang-github-lusitaniae-apache_exporter
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
python2-hwdata
golang-github-prometheus-prometheus
mgr-virtualization-host
python3-mgr-virtualization-host
python3-mgr-virtualization-common
spacewalk-oscap
python3-spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
mgr-cfg-actions
mgr-cfg
mgr-cfg-client
mgr-cfg-management
python3-mgr-cfg
python3-mgr-cfg-actions
python3-mgr-cfg-client
python3-mgr-cfg-management
python3-mgr-osa-common
python3-mgr-osad
mgr-osad
spacecmd
python3-spacewalk-check
spacewalk-client-setup
spacewalk-client-tools
spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-client-tools
supportutils-plugin-susemanager-client
mgr-custom-info
spacewalk-remote-utils
python2-suseRegisterInfo
python2-uyuni-common-libs
python2-mgr-push
mgr-daemon
python2-rhnlib
python2-mgr-virtualization-common
python2-mgr-virtualization-host
python2-spacewalk-oscap
python2-spacewalk-koan
python2-mgr-cfg-management
python2-mgr-cfg-client
python2-mgr-cfg-actions
python2-mgr-cfg
python2-mgr-osad
python2-mgr-osa-common
python2-spacewalk-check
python2-spacewalk-client-setup
python2-spacewalk-client-tools
grafana
grafana-debuginfo
grafana (Red Hat package)

Install updates from vendor's website.

Grafana - addressed in versions 7.5.13, 8.3.4
IBM Watson Machine Learning Accelerator - update to 3.0.0
OpenShift Service Mesh - update to 2.3.1
kiwi-desc-saltboot - update to 0.1.1687520761.cefb248-4.15.2
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-1.6.1, 0.4.0-4.6.2
prometheus-postgres_exporter - addressed in versions 0.10.0-1.8.2, 0.10.0-150000.1.3.1, 0.10.1-3.6.4
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-1.12.3, 0.26.0-4.12.4
system-user-prometheus - update to 1.0.0-3.7.2
system-user-grafana - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - update to 1.0.0-4.12.4
supportutils-plugin-salt - addressed in versions 1.2.0-6.16.1, 1.2.2-9.9.2
golang-github-prometheus-node_exporter - addressed in versions 1.3.0-1.15.3, 1.5.0-4.15.4
golang-github-boynux-squid_exporter - update to 1.6-4.9.2
python2-hwdata - addressed in versions 2.3.5-12.9.1, 2.3.5-15.12.2
golang-github-prometheus-prometheus - update to 2.45.0-4.33.3
mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.5-1.29.3
python3-mgr-virtualization-host - update to 4.2.4-150000.1.26.1
python3-mgr-virtualization-common - update to 4.2.4-150000.1.26.1
spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.5-19.27.1
python3-spacewalk-oscap - update to 4.2.4-150000.3.18.1
python3-mgr-push - update to 4.2.5-150000.1.18.2
mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.4-1.21.4, 5.0.1-4.21.4
python3-suseRegisterInfo - update to 4.2.6-150000.3.21.1
suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.3-25.27.3
python3-spacewalk-koan - update to 4.2.6-150000.3.27.1
spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.5-24.33.3
python3-rhnlib - update to 4.2.6-150000.3.34.1
mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.6-1.27.4
python3-mgr-cfg - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-actions - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-client - update to 4.2.8-150000.1.24.1
python3-mgr-cfg-management - update to 4.2.8-150000.1.24.1
python3-mgr-osa-common - update to 4.2.8-150000.1.36.1
python3-mgr-osad - update to 4.2.8-150000.1.36.1
mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.6-1.39.4
spacecmd - addressed in versions 4.2.16-150000.3.77.1, 4.3.11-38.103.3, 5.0.1-41.42.3
python3-spacewalk-check - update to 4.2.18-150000.3.59.1
spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.9-52.71.3
python3-spacewalk-client-setup - update to 4.2.18-150000.3.59.1
python3-spacewalk-client-tools - update to 4.2.18-150000.3.59.1
supportutils-plugin-susemanager-client - addressed in versions 4.3.2-6.24.1, 5.0.1-9.15.2
mgr-custom-info - update to 4.3.3-1.18.1
spacewalk-remote-utils - update to 4.3.3-24.24.3
python2-suseRegisterInfo - update to 4.3.3-25.27.3
python2-uyuni-common-libs - addressed in versions 4.3.4-1.21.3, 5.0.1-3.33.3
python2-mgr-push - addressed in versions 4.3.4-1.21.4, 5.0.1-4.21.4
mgr-daemon - update to 4.3.4-1.32.3
python2-rhnlib - addressed in versions 4.3.4-21.43.3, 5.0.1-24.30.3
python2-mgr-virtualization-common - update to 4.3.5-1.29.3
python2-mgr-virtualization-host - update to 4.3.5-1.29.3
python2-spacewalk-oscap - update to 4.3.5-19.27.1
python2-spacewalk-koan - update to 4.3.5-24.33.3
python2-mgr-cfg-management - update to 4.3.6-1.27.4
python2-mgr-cfg-client - update to 4.3.6-1.27.4
python2-mgr-cfg-actions - update to 4.3.6-1.27.4
python2-mgr-cfg - update to 4.3.6-1.27.4
python2-mgr-osad - update to 4.3.6-1.39.4
python2-mgr-osa-common - update to 4.3.6-1.39.4
python2-spacewalk-check - update to 4.3.9-52.71.3
python2-spacewalk-client-setup - update to 4.3.9-52.71.3
python2-spacewalk-client-tools - update to 4.3.9-52.71.3
grafana - update to 7.5.11-3
grafana-debuginfo - update to 7.5.11-3
grafana - addressed in versions 7.5.15-2.fc34, 7.5.15-2.fc35, 7.5.15-2.fc36
grafana (Red Hat package) - addressed in versions 7.5.15-3.el8, 7.5.15-3.el9
grafana - addressed in versions 8.3.5-1.30.3, 8.3.5-150000.1.30.1, 8.5.13-150100.3.12.1, 9.5.8-4.21.2
grafana-debuginfo - addressed in versions 8.3.5-150000.1.30.1, 8.5.13-150100.3.12.1

• https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4
• https://github.com/grafana/grafana/releases/tag/v8.3.4
• https://github.com/grafana/grafana/releases/tag/v7.5.13
• https://security.netapp.com/advisory/ntap-20220303-0004/
• https://bugzilla.redhat.com/show_bug.cgi?id=2044628

• Information disclosure in Grafana
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Red Hat Ceph Storage 5.2
• SUSE update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• SUSE update for SUSE Manager Client Tools
• Multiple vulnerabilities in Oracle Linux
• SUSE update for Security Beta update for SUSE Manager Client Tools
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for grafana
• Fedora 36 update for grafana
• Fedora 35 update for grafana
• Fedora 34 update for grafana