Security Bulletin: IBM Storage Ceph is vulnerable to an incorrect authorization vulnerablity in Grafana.

Summary

Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-31107.

Vulnerability Details

CVEID:CVE-2022-31107
**DESCRIPTION:**Grafana could allow a remote authenticated attacker to bypass security restrictions, caused by an OAuth vulnerability. By sending a specially-crafted request using the username of the target user, an attacker could exploit this vulnerability to takeover an administrative account.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231304 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.
Download the latest version of Ceph and upgrade to 6.1 by following instructions.

Workarounds and Mitigations

None