cnvd - cnvd-2022-06890

cnvd-2022-06890

Vulnerability from cnvd

Title: Grafana信息泄露漏洞（CNVD-2022-06890）

Description:

Grafana是Grafana实验室的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。

Grafana存在信息泄露漏洞，该漏洞源于在受影响的版本中，当数据源启用了Forward OAuth Identity特性时，向该数据源发送带有API令牌(且没有其他用户凭据)的查询将转发最近登录用户的OAuth Identity。这允许API令牌持有者检索他们可能不打算访问的数据。目前没有详细的漏洞细节提供。

Severity: 中

Patch Name: Grafana信息泄露漏洞（CNVD-2022-06890）的补丁

Patch Description:

Grafana是Grafana实验室的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-21673

Impacted products

Name
Grafana Grafana

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-21673"
    }
  },
  "description": "Grafana\u662fGrafana\u5b9e\u9a8c\u5ba4\u7684\u4e00\u5957\u63d0\u4f9b\u53ef\u89c6\u5316\u76d1\u63a7\u754c\u9762\u7684\u5f00\u6e90\u76d1\u63a7\u5de5\u5177\u3002\u8be5\u5de5\u5177\u4e3b\u8981\u7528\u4e8e\u76d1\u63a7\u548c\u5206\u6790Graphite\u3001InfluxDB\u548cPrometheus\u7b49\u3002\n\nGrafana\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u53d7\u5f71\u54cd\u7684\u7248\u672c\u4e2d\uff0c\u5f53\u6570\u636e\u6e90\u542f\u7528\u4e86Forward OAuth Identity\u7279\u6027\u65f6\uff0c\u5411\u8be5\u6570\u636e\u6e90\u53d1\u9001\u5e26\u6709API\u4ee4\u724c(\u4e14\u6ca1\u6709\u5176\u4ed6\u7528\u6237\u51ed\u636e)\u7684\u67e5\u8be2\u5c06\u8f6c\u53d1\u6700\u8fd1\u767b\u5f55\u7528\u6237\u7684OAuth Identity\u3002\u8fd9\u5141\u8bb8API\u4ee4\u724c\u6301\u6709\u8005\u68c0\u7d22\u4ed6\u4eec\u53ef\u80fd\u4e0d\u6253\u7b97\u8bbf\u95ee\u7684\u6570\u636e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-06890",
  "openTime": "2022-01-26",
  "patchDescription": "Grafana\u662fGrafana\u5b9e\u9a8c\u5ba4\u7684\u4e00\u5957\u63d0\u4f9b\u53ef\u89c6\u5316\u76d1\u63a7\u754c\u9762\u7684\u5f00\u6e90\u76d1\u63a7\u5de5\u5177\u3002\u8be5\u5de5\u5177\u4e3b\u8981\u7528\u4e8e\u76d1\u63a7\u548c\u5206\u6790Graphite\u3001InfluxDB\u548cPrometheus\u7b49\u3002\r\n\r\nGrafana\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u53d7\u5f71\u54cd\u7684\u7248\u672c\u4e2d\uff0c\u5f53\u6570\u636e\u6e90\u542f\u7528\u4e86Forward OAuth Identity\u7279\u6027\u65f6\uff0c\u5411\u8be5\u6570\u636e\u6e90\u53d1\u9001\u5e26\u6709API\u4ee4\u724c(\u4e14\u6ca1\u6709\u5176\u4ed6\u7528\u6237\u51ed\u636e)\u7684\u67e5\u8be2\u5c06\u8f6c\u53d1\u6700\u8fd1\u767b\u5f55\u7528\u6237\u7684OAuth Identity\u3002\u8fd9\u5141\u8bb8API\u4ee4\u724c\u6301\u6709\u8005\u68c0\u7d22\u4ed6\u4eec\u53ef\u80fd\u4e0d\u6253\u7b97\u8bbf\u95ee\u7684\u6570\u636e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Grafana\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2022-06890\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Grafana Grafana"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-21673",
  "serverity": "\u4e2d",
  "submitTime": "2022-01-19",
  "title": "Grafana\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2022-06890\uff09"
}

CVE-2022-21673 (GCVE-0-2022-21673)

Vulnerability from cvelistv5

Published

2022-01-18 21:35

Modified

2025-04-23 19:11

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Summary

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.

References

▼	URL	Tags
	https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4	x_refsource_CONFIRM
	https://github.com/grafana/grafana/releases/tag/v7.5.13	x_refsource_MISC
	https://github.com/grafana/grafana/releases/tag/v8.3.4	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220303-0004/	x_refsource_CONFIRM
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	grafana	grafana	Version: >= 7.2.0, < 7.5.13 Version: >= 8.0.0, < 8.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.413Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grafana/grafana/releases/tag/v7.5.13"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/grafana/grafana/releases/tag/v8.3.4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220303-0004/"
          },
          {
            "name": "FEDORA-2022-83405f9d5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"
          },
          {
            "name": "FEDORA-2022-9dd03cab55",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"
          },
          {
            "name": "FEDORA-2022-c5383675d9",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:12:04.035353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:11:00.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grafana",
          "vendor": "grafana",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.0, \u003c 7.5.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-07T07:06:34.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grafana/grafana/releases/tag/v7.5.13"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/grafana/grafana/releases/tag/v8.3.4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220303-0004/"
        },
        {
          "name": "FEDORA-2022-83405f9d5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"
        },
        {
          "name": "FEDORA-2022-9dd03cab55",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"
        },
        {
          "name": "FEDORA-2022-c5383675d9",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"
        }
      ],
      "source": {
        "advisory": "GHSA-8wjh-59cw-9xh4",
        "discovery": "UNKNOWN"
      },
      "title": "OAuth Identity Token exposure in Grafana",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-21673",
          "STATE": "PUBLIC",
          "TITLE": "OAuth Identity Token exposure in Grafana"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "grafana",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 7.2.0, \u003c 7.5.13"
                          },
                          {
                            "version_value": "\u003e= 8.0.0, \u003c 8.3.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "grafana"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4",
              "refsource": "CONFIRM",
              "url": "https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4"
            },
            {
              "name": "https://github.com/grafana/grafana/releases/tag/v7.5.13",
              "refsource": "MISC",
              "url": "https://github.com/grafana/grafana/releases/tag/v7.5.13"
            },
            {
              "name": "https://github.com/grafana/grafana/releases/tag/v8.3.4",
              "refsource": "MISC",
              "url": "https://github.com/grafana/grafana/releases/tag/v8.3.4"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220303-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220303-0004/"
            },
            {
              "name": "FEDORA-2022-83405f9d5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/"
            },
            {
              "name": "FEDORA-2022-9dd03cab55",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/"
            },
            {
              "name": "FEDORA-2022-c5383675d9",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8wjh-59cw-9xh4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21673",
    "datePublished": "2022-01-18T21:35:10.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:11:00.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted