Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

🗓️ 12 Oct 2022 00:00:00Reported by Grafana LabsType

Grafana before 8.5.14 and 9.1.8 may leak user cookies to plugins via data source endpoints.

Reporter	Title	Published	Views	Family All 96
FreeBSD	Grafana -- Plugin signature bypass	4 Jul 202200:00	–	freebsd
FreeBSD	Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins	7 Sep 202200:00	–	freebsd
FreeBSD	Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins	26 Jun 202200:00	–	freebsd
FreeBSD	Grafana -- Improper authentication	7 Sep 202200:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana [CVE-2022-39201]	1 Nov 202319:49	–	ibm
AlpineLinux	CVE-2022-39201	13 Oct 202223:15	–	alpinelinux
AlmaLinux	Moderate: grafana security and enhancement update	7 Nov 202300:00	–	almalinux
ALT Linux	Security fix for the ALT Linux 10 package grafana version 8.5.20-alt1	31 Jan 202300:00	–	altlinux
BDU FSTEC	The vulnerability of the Grafana monitoring and observation platform, related to the disclosure of confidential information to unauthorized entities, allows attackers to expose the protected information.	5 Apr 202400:00	–	bdu_fstec
Chainguard	CVE-2022-39201 vulnerabilities	13 Oct 202223:15	–	cgr