Security Bulletin: Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana

Summary

Watson Machine Learning Accelerator on Cloud Pak for Data had an internal dependency on Grafana. Grafana dependency is now removed. Grafana component is no longer used or shipped with Watson Machine Learning Accelerator on Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2022-39302
**DESCRIPTION:**Ree6 could allow a remote attacker to bypass security restrictions, caused by containing a channel from other server for sending log messages. By using a specially crafted Log-Message, an attacker could exploit this vulnerability to bypass raid and spam protections.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241438 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-32276
**DESCRIPTION:**Grafana could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request for snapshot query using random key parameters, an attacker could exploit this vulnerability to gain access to the system dashboard area by going through the login page.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228383 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-31123
**DESCRIPTION:**Grafana could allow a local authenticated attacker to bypass security restrictions, caused by an error in the plugin signature verification. An attacker could exploit this vulnerability to convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238624 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L)

CVEID:CVE-2022-36062
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper preservation of permissions. By sending a specially-crafted request, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 6.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236931 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L)

CVEID:CVE-2022-39328
**DESCRIPTION:**Grafana could allow a remote attacker to gain elevated privileges on the system, caused by a race condition in the authentication middlewares logic. By sending specially-crafted requests, an attacker could exploit this vulnerability to gain elevated privileges on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239700 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-41090
**DESCRIPTION:**Grafana Agent could allow a remote attacker to obtain sensitive information, caused by the transmission of secrets in plain text. By sniffing the network traffic, an attacker could exploit this vulnerability to obtain secrets configuration information, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215062 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-21703
**DESCRIPTION:**Grafana is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote authenticated attacker could send a malformed HTTP request to create a new administrator account. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219280 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N)

CVEID:CVE-2022-39307
**DESCRIPTION:**Grafana could allow a remote attacker to obtain sensitive information, caused by an error related to the use of the forget password on the login page. By sending a POST request to the /api/user/password/sent-reset-email URL and the username or email does not exist an attacker could exploit this vulnerability to enumerate the username.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239844 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-31097
**DESCRIPTION:**Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Unified Alerting feature. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231305 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

CVEID:CVE-2022-39306
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper input validation. By sending an email invite, an attacker with access to the link could exploit this vulnerability to sign up with whatever username/email address the user chooses and become a member of the organization.
CVSS Base score: 6.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239843 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)

CVEID:CVE-2022-32275
**DESCRIPTION:**Grafana could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to the login form containing “dot dot” sequences (/…/) to read arbitrary files on the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228138 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-26148
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to obtain sensitive information, caused by storing sensitive information in api_jsonrpc.php HTML source code when integrated with Zabbix. By viewing the source code, an attacker could exploit this vulnerability to obtain the victim’s Zabbix account password and URL address.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222282 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:CVE-2021-43815
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of requests. An attacker could send a specially-crafted URL request containing “dot dot” sequences (/…/) to view arbitrary CSV files on the system. Note: This only affects instances that have the developer testing tool called TestData DB data source enabled and configured.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215138 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-31107
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to bypass security restrictions, caused by an OAuth vulnerability. By sending a specially-crafted request using the username of the target user, an attacker could exploit this vulnerability to takeover an administrative account.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231304 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)

CVEID:CVE-2022-39229
**DESCRIPTION:**Grafana could allow a remote attacker to bypass security restrictions, caused by improper authentication. By using email as a username can block other users from signing in, an attacker could exploit this vulnerability to gain access to the system dashboard area by going through the login page.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241445 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-24812
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when fine-grained access control is enabled. By sending a specially-crafted request, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224284 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2022-21713
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to obtain sensitive information, caused by an insecure direct object reference in the API. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authorization and obtain privileged data.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219279 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-46156
**DESCRIPTION:**Grafana Synthetic Monitoring Agent could allow a remote attacker to obtain sensitive information, caused by an issue with the authentication token used to communicate with the Synthetic Monitoring API is exposed through a debugging endpoint. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/243258 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

CVEID:CVE-2022-35957
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to take over the server admin account and gain full control of the Grafana instance.
CVSS Base score: 6.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/236783 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2022-29170
**DESCRIPTION:**Grafana Enterprise could allow a remote attacker to bypass security restrictions. By returning an HTTP redirect to a forbidden host via allowed host, an attacker could exploit this vulnerability to bypass security configurations .
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/227079 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-28660
**DESCRIPTION:**Grafana Enterprise Logs could allow a remote attacker to bypass security restrictions, caused by a flaw in the querier component when X-Scope-OrgID is used. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass authentication.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/227060 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-31176
**DESCRIPTION:**Grafana Image Renderer could allow a remote authenticated attacker to obtain sensitive information, caused by an unauthorized file disclosure vulnerability. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to retrieve unauthorized files under some network conditions.
CVSS Base score: 8.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235284 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)

CVEID:CVE-2021-41244
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when the fine-grained access control beta feature is enabled. By sending a specially-crafted request, an attacker could exploit this vulnerability to list, add, remove, and update user roles in other organizations.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213593 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2022-39303
**DESCRIPTION:**Ree6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to view, add, modify or delete information in the back-end database.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241436 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2022-21702
**DESCRIPTION:**Grafana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Grafana datasource or plugin proxy. A remote authenticated attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219281 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N)

CVEID:CVE-2022-39201
**DESCRIPTION:**Grafana could allow a remote attacker to obtain sensitive information, caused by leaking the authentication cookie. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241446 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2021-43798
**DESCRIPTION:**Grafana could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted URL request to the /public/plugins/ containing “dot dot” sequences (/…/) to view arbitrary files on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214666 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-43813
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request by the /api/plugins/ endpoint. An attacker could send a specially-crafted URL request containing “dot dot” sequences (/…/) to view fully lowercase or fully uppercase MD files on the system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215139 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2022-21673
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the Forward OAuth Identity feature. An attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217800 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

1. For Watson Machine Learning Accelerator version 2.4, 2.4.1, 2.5.0,2.6.0
Follow <https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=accelerator-upgrading&gt; to upgrade from WMLA 2.4.x/2.5.0/2.6.0 to WMLA 3.0.0 or above version.

2. For Watson Machine Learning Accelerator version 2.3, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9
To address the affected version, first upgrade to IBM Watson Machine Learning Accelerator 2.3.5 by following the document
https://www.ibm.com/docs/en/wmla/2.3?topic=installation-install-upgrade Then upgrade from WMLA 2.3.5 to WMLA 3.0.0 or above version following
<https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=accelerator-upgrading&gt;

3. For Watson Machine Learning Accelerator version 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6
To address the affected version
a. upgrade to IBM Watson Machine Learning Accelerator 2.3.5 following <https://www.ibm.com/docs/en/wmla/2.3?topic=installation-install-upgrade&gt;
b. upgrade from WMLA 2.3.5 to WMLA 3.0.0 or above version following <https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=accelerator&gt;

Workarounds and Mitigations

None