CVE-2022-21713
Summary
| CVE | CVE-2022-21713 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-02-08 21:15:00 UTC |
|---|
| Updated | 2023-11-07 03:43:00 UTC |
|---|
| Description | Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 35 Update: grafana-7.5.15-2.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Grafana 7.5.15 and 8.3.5 released with moderate severity security fixes | Grafana Labs |
MISC |
grafana.com |
|
| CVE-2022-21713: Grafana Teams API IDOR · Advisory · grafana/grafana · GitHub |
CONFIRM |
github.com |
|
| February 2022 Grafana Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] Fedora 36 Update: grafana-7.5.15-2.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: grafana-7.5.15-2.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 36 Update: grafana-7.5.15-2.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: grafana-7.5.15-2.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 35 Update: grafana-7.5.15-2.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Security: Sync security changes on main by dsotirakis · Pull Request #45083 · grafana/grafana · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160238 Oracle Enterprise Linux Security Update for grafana (ELSA-2022-7519)
- 160278 Oracle Enterprise Linux Security Update for grafana (ELSA-2022-8057)
- 240850 Red Hat Update for grafana security (RHSA-2022:7519)
- 240902 Red Hat Update for grafana security (RHSA-2022:8057)
- 282601 Fedora Security Update for grafana (FEDORA-2022-83405f9d5b)
- 282602 Fedora Security Update for grafana (FEDORA-2022-9dd03cab55)
- 502305 Alpine Linux Security Update for grafana
- 690803 Free Berkeley Software Distribution (FreeBSD) Security Update for grafana (d71d154a-8b83-11ec-b369-6c3be5272acd)
- 730423 Grafana Multiple Security Vulnerabilities
- 752251 SUSE Enterprise Linux Security Update for SUSE Manager Client Tools (SUSE-SU-2022:2134-1)
- 753255 SUSE Enterprise Linux Security Update for grafana (SUSE-SU-2022:3765-1)
- 940770 AlmaLinux Security Update for grafana (ALSA-2022:7519)
- 940826 AlmaLinux Security Update for grafana (ALSA-2022:8057)
- 960182 Rocky Linux Security Update for grafana (RLSA-2022:7519)
- 960528 Rocky Linux Security Update for grafana (RLSA-2022:8057)
