CVE-2022-39201

A flaw was found in Grafana. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. Grafana could leak the authentication cookie of users to plugins, which could result in an impact to confidentiality, integrity, and availability...

CVE-2022-31130

A flaw was found in Grafana's use of the GitLab data source plugin, leaking the API key to gitlab. This can result in the destination plugin receiving a Grafana user's authentication token, which could be used by an attacker...

UBUNTU-CVE-2022-39201

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-39201

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-31130: Exposure of Sensitive Information to an Unauthorized Actor

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

CVE-2022-31130 Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

PT-2022-7310

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 9.1.8 Grafana versions prior to 8.5.14 Description The issue is related to the transmission of authentication tokens to certain destination plugins in the Grafana platform, which could allow a remote attacker to...

PT-2022-7309

Name of the Vulnerable Software and Affected Versions Grafana versions 5.0.0-beta1 through 8.5.13 Grafana versions 9.0.0 through 9.1.7 Description The issue is related to the transmission of user authentication cookies to plugins, potentially allowing a remote attacker to disclose protected...

CVE-2022-39201 Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-39201

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-39201

Grafana CVE-2022-39201 affects Grafana before patches in 8.5.14 and 9.1.8. The issue allows a destination plugin to receive a user’s Grafana authentication cookie via data source and plugin proxy endpoints under certain conditions, enabling cookie leakage. Patched in Grafana 8.5.14 and 9.1.8; oth...

CVE-2022-39201: Exposure of Sensitive Information to an Unauthorized Actor

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

CVE-2022-31130

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

Token Leakage in Proxy in Grafana

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...

Cookie Leakage in Proxy in Grafana

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain...

WebDriver Mozilla Firefox Disclosure Code Execution

The vulnerability of the WebDriver driver for the Mozilla Firefox browser is related to a lack of mechanisms for verifying the data source. Exploiting this vulnerability allows a malicious actor, operating remotely, to circumvent established security restrictions, disclose sensitive information,...

Dairy Farm Shop Management System SQL Injection Vulnerability

Dairy Farm Shop Management System is a Dairy Farm Shop Management System by the individual developer Anuj Kumar. A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0, which was discovered to contain an SQL injection attack via sales-report-ds.php...

Mozilla Firefox Data Source Verification Spear Phishing

The vulnerability of the Mozilla Firefox browser is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability allows an attacker to perform spear-phishing attacks remotely...

CVE-2022-34916

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java...

Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe...