Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-21703
HistoryFeb 08, 2022 - 9:15 p.m.

CVE-2022-21703

2022-02-0821:15:20
CWE-352
[email protected]
web.nvd.nist.gov
2

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.4%

JSON

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Affected configurations

NVD
Node
grafanagrafanaRange3.0.1–7.5.15
OR
grafanagrafanaRange8.0.0–8.3.5
OR
grafanagrafanaMatch3.0.0beta1
OR
grafanagrafanaMatch3.0.0beta2
OR
grafanagrafanaMatch3.0.0beta3
OR
grafanagrafanaMatch3.0.0beta4
OR
grafanagrafanaMatch3.0.0beta5
OR
grafanagrafanaMatch3.0.0beta6
OR
grafanagrafanaMatch3.0.0beta7
Node
netappe-series_performance_analyzerRange<3.0
Node
fedoraprojectfedoraMatch34
OR
fedoraprojectfedoraMatch35
OR
fedoraprojectfedoraMatch36

Related

redhatcve 1
veracode 1
prion 1
freebsd 1
openvas 7
osv 7
cnvd 1
hackerone 2
alpinelinux 1
ibm 2
ubuntucve 1
cvelist 1
cve 1
github 1
suse 2
nessus 13
fedora 3
altlinux 1
rocky 2
redhat 3
almalinux 2
oraclelinux 2
redos 1
redhatcve
redhatcve
CVE-2022-21703
2022-02-11 11:29:40
veracode
veracode
Cross Site Request Forgery (CSRF)
2022-02-14 02:32:26
prion
prion
Cross site request forgery (csrf)
2022-02-08 21:15:00
freebsd
freebsd
Grafana -- CSRF
2022-01-18 00:00:00
openvas
openvas
Grafana CSRF Vulnerability (GHSA-cmf4-h3xc-jw8w)
2022-02-10 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3765-1)
2022-10-27 00:00:00
Fedora: Security Advisory for grafana (FEDORA-2022-83405f9d5b)
2022-04-21 00:00:00
osv
osv
CVE-2022-21703
2022-02-08 21:15:20
BIT-grafana-2022-21703
2024-03-06 10:58:16
Grafana Cross Site Request Forgery (CSRF)
2024-02-01 00:16:02
cnvd
cnvd
Grafana Cross-Site Request Forgery Vulnerability
2022-03-07 00:00:00
hackerone
hackerone
Kubernetes: monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day)
2022-02-01 12:17:30
Aiven Ltd: 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .
2022-01-22 19:38:08
alpinelinux
alpinelinux
CVE-2022-21703
2022-02-08 21:15:20
ibm
ibm
Security Bulletin: IBM Storage Ceph is vulnerable to Cross-Site Request Forgery in Grafana (CVE-2022-21703)
2023-11-01 19:58:40
Security Bulletin: Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana
2023-11-17 16:01:52
ubuntucve
ubuntucve
CVE-2022-21703
2022-02-08 00:00:00
cvelist
cvelist
CVE-2022-21703 Cross Site Request Forgery in Grafana
2022-02-08 20:40:10
cve
cve
CVE-2022-21703
2022-02-08 21:15:20
github
github
Grafana Cross Site Request Forgery (CSRF)
2024-02-01 00:16:02
suse
suse
Security update for grafana (important)
2022-10-26 00:00:00
Security update for SUSE Manager Client Tools (moderate)
2022-04-25 00:00:00
nessus
nessus
SUSE SLED15 / SLES15 Security Update : grafana (SUSE-SU-2022:3765-1)
2022-10-27 00:00:00
openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2022:1396-1)
2023-01-20 00:00:00
SUSE SLES12 Security Update : SUSE Manager Client Tools (SUSE-SU-2022:2134-1)
2022-06-22 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: grafana-7.5.15-2.fc35
2022-04-20 19:12:21
[SECURITY] Fedora 34 Update: grafana-7.5.15-2.fc34
2022-04-20 19:16:53
[SECURITY] Fedora 36 Update: grafana-7.5.15-2.fc36
2022-05-07 04:56:19
altlinux
altlinux
Security fix for the ALT Linux 10 package grafana version 8.5.0-alt1
2022-05-05 00:00:00
rocky
rocky
grafana security, bug fix, and enhancement update
2022-11-08 06:21:47
grafana security, bug fix, and enhancement update
2022-11-15 06:14:26
redhat
redhat
(RHSA-2022:8057) Important: grafana security, bug fix, and enhancement update
2022-11-15 06:14:26
(RHSA-2022:7519) Moderate: grafana security, bug fix, and enhancement update
2022-11-08 06:21:47
(RHSA-2023:0542) Important: Red Hat OpenShift Service Mesh 2.3.1 Containers security update
2023-01-30 16:30:30
almalinux
almalinux
Important: grafana security, bug fix, and enhancement update
2022-11-15 00:00:00
Moderate: grafana security, bug fix, and enhancement update
2022-11-08 00:00:00
oraclelinux
oraclelinux
grafana security, bug fix, and enhancement update
2022-11-15 00:00:00
grafana security, bug fix, and enhancement update
2022-11-22 00:00:00
redos
redos
ROS-20240403-01
2024-04-03 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.4%

JSON
Related for NVD:CVE-2022-21703
redhatcve1veracode1prion1freebsd1openvas7osv7cnvd1hackerone2alpinelinux1ibm2ubuntucve1cvelist1cve1github1suse2nessus13fedora3altlinux1rocky2redhat3almalinux2oraclelinux2redos1