SB2022060233 - openEuler update for grafana 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022060233

SB2022060233 - openEuler update for grafana

Published: June 2, 2022

Security Bulletin ID SB2022060233
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2022-21703)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim into inviting the attacker as a new user with high privileges to escalate privileges.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2022-21713)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an Insecure Direct Object Reference (IDOR) error in Grafana Teams APIs. A remote authenticated user can view unintended data by querying for the specific team ID or search for teams and see the total number of available teams.


Remediation

Install update from vendor's website.

References