Information Disclosure

🗓️ 17 Oct 2022 11:15:16Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 39 Views

grafana information disclosure vulnerability due to proxy endpoints leaking sensitive authentication tokens

Reporter	Title	Published	Views	Family All 249
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana (CVE-2022-31130)	19 Jan 202422:18	–	ibm
IBM Security Bulletins	Security Bulletin: Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana	26 Mar 202502:48	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities (CVE-2008-5730, CVE-2015-5237, CVE-2018-12020, CVE-2019-13050, CVE-2019-14855, CVE-2019-1543, CVE-2020-25125, CVE-2021-3712, CVE-2022-31130, CVE-2023-0464, CVE-2022-1292)	11 Aug 202513:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana [CVE-2022-39201]	1 Nov 202319:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to improper authentication in Grafana (CVE-2022-39229)	1 Nov 202319:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to improper verification of cryptographic signature in Grafana (CVE-2022-31123)	1 Nov 202320:00	–	ibm
FreeBSD	Grafana -- Plugin signature bypass	4 Jul 202200:00	–	freebsd
FreeBSD	Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins	7 Sep 202200:00	–	freebsd
FreeBSD	Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins	26 Jun 202200:00	–	freebsd
FreeBSD	Grafana -- Improper authentication	7 Sep 202200:00	–	freebsd

Vulners

Node

grafana github.com/grafana/grafanaRangev3.0-beta1–3.0-beta1go

grafana github.com/grafana/grafanaRangev9.0.0-beta1–9.0.0-beta1go

grafana github.com/grafana/grafanaRangev9.2.0-beta1–9.2.0-beta1go

grafana grafanaMatch7.5.9_3.el8

grafana grafanaMatch9.2.10_3.el8

grafana grafanaMatch7.5.9_2.el8

grafana grafanaMatch6.7.4_3.el8

grafana grafanaMatch6.3.6_1.el8

grafana grafanaMatch7.5.15_1.el8

grafana grafanaMatch7.3.6_1.el8

grafana grafanaMatch7.5.11_1.el8

grafana grafanaMatch7.5.9_4.el8

grafana grafanaMatch7.5.15_3.el8

grafana grafanaMatch6.2.2_2.el8

grafana grafanaMatch7.3.4_1.el8

grafana grafanaMatch7.5.10_1.el8

grafana grafanaMatch6.3.6_2.el8_2

grafana grafanaMatch6.7.4_1.el8

grafana grafanaMatch7.3.6_3.el8_4

grafana grafanaMatch7.5.15_2.el8

grafana grafanaMatch7.3.6_2.el8

grafana grafanaMatch7.5.15_4.el8

grafana grafanaMatch7.5.11_2.el8

grafana grafanaMatch9.2.10_4.el8

grafana grafanaMatch7.5.7_1.el8

grafana grafanaMatch7.5.9_1.el8

grafana grafanaMatch7.5.7_2.el8

Source	Link
github	www.github.com/grafana/grafana/issues/562
github	www.github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177
github	www.github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f
github	www.github.com/grafana/grafana/commit/4539c33fce5ef23badb08ebcbc09cb0cecb1f539
grafana	www.grafana.com/blog/2022/10/12/grafana-security-releases-new-versions-with-fixes-for-cve-2022-39229-cve-2022-39201-cve-2022-31130-cve-2022-31123/
github	www.github.com/grafana/grafana/releases/tag/v9.1.8
github	www.github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc

18 Oct 2022 13:06Current

7.5High risk

Vulners AI Score7.5

CVSS 3.14.9 - 7.5

EPSS0.01228