CVE-2022-31130
Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.05% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-522
- Affected
- grafana/grafana
- Source
- security-advisories@github.com
References
- https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177Patch, Third Party Advisory
- https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885fPatch, Third Party Advisory
- https://github.com/grafana/grafana/releases/tag/v9.1.8Release Notes, Third Party Advisory
- https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjcPatch, Third Party Advisory
- https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177Patch, Third Party Advisory
- https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885fPatch, Third Party Advisory
- https://github.com/grafana/grafana/releases/tag/v9.1.8Release Notes, Third Party Advisory
- https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjcPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.