RHSA-2023:6420
Vulnerability from csaf_opensuse - Published: 2023-11-07 00:00 - Updated: 2026-09-20 11:32Summary
security update for grafana
Severity
Low
Notes
Title of the patch: security update for grafana
Description of the patch: This security update provides a functional equivalent of RHSA-2023:6420.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2023:6420.
Patchnames: RHSA-2023:6420
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.3 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
4 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
4.4 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
critical
4.4 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
6.4 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
6.7 (Medium)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
important
7.5 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
important
9.4 (Critical)
Affected products
Recommended
1 product, the same list as for
CVE-2022-23552
Threats
Impact
critical
References
34 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Low"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2023:6420.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2023:6420.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2023:6420",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_6420.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-23552 page",
"url": "https://www.suse.com/security/cve/CVE-2022-23552/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-31123 page",
"url": "https://www.suse.com/security/cve/CVE-2022-31123/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-31130 page",
"url": "https://www.suse.com/security/cve/CVE-2022-31130/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-37601 page",
"url": "https://www.suse.com/security/cve/CVE-2022-37601/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-39201 page",
"url": "https://www.suse.com/security/cve/CVE-2022-39201/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-39306 page",
"url": "https://www.suse.com/security/cve/CVE-2022-39306/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-39307 page",
"url": "https://www.suse.com/security/cve/CVE-2022-39307/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-39324 page",
"url": "https://www.suse.com/security/cve/CVE-2022-39324/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-41717 page",
"url": "https://www.suse.com/security/cve/CVE-2022-41717/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-24534 page",
"url": "https://www.suse.com/security/cve/CVE-2023-24534/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-3128 page",
"url": "https://www.suse.com/security/cve/CVE-2023-3128/"
}
],
"title": "security update for grafana",
"tracking": {
"current_release_date": "2026-09-20T11:32:29Z",
"generator": {
"date": "2023-11-07T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2023:6420",
"initial_release_date": "2023-11-07T00:00:00Z",
"revision_history": [
{
"date": "2023-11-07T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-15T08:43:50Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-20T11:32:29Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-7.el9_3.x86_64",
"product": {
"name": "grafana-0:9.2.10-7.el9_3.x86_64",
"product_id": "grafana-0:9.2.10-7.el9_3.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:grafana:grafana:9.2.10:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/grafana@9.2.10-7.el9_3?arch=x86_64\u0026upstream=grafana-0:9.2.10-7.el9_3.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 9",
"product": {
"name": "SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:9"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-7.el9_3.x86_64 as component of SUSE Liberty Linux 9",
"product_id": "SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
},
"product_reference": "grafana-0:9.2.10-7.el9_3.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23552",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-23552"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren\u0027t properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. \n\nAn attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. \n\nUsers may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-23552",
"url": "https://www.suse.com/security/cve/CVE-2022-23552"
},
{
"category": "external",
"summary": "SUSE Bug 1207749 for CVE-2022-23552",
"url": "https://bugzilla.suse.com/1207749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-23552"
},
{
"cve": "CVE-2022-31123",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-31123"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-31123",
"url": "https://www.suse.com/security/cve/CVE-2022-31123"
},
{
"category": "external",
"summary": "SUSE Bug 1204302 for CVE-2022-31123",
"url": "https://bugzilla.suse.com/1204302"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-31123"
},
{
"cve": "CVE-2022-31130",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-31130"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user\u0027s Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-31130",
"url": "https://www.suse.com/security/cve/CVE-2022-31130"
},
{
"category": "external",
"summary": "SUSE Bug 1204305 for CVE-2022-31130",
"url": "https://bugzilla.suse.com/1204305"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-31130"
},
{
"cve": "CVE-2022-37601",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-37601"
}
],
"notes": [
{
"category": "general",
"text": "Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-37601",
"url": "https://www.suse.com/security/cve/CVE-2022-37601"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2022-37601"
},
{
"cve": "CVE-2022-39201",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-39201"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user\u0027s Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-39201",
"url": "https://www.suse.com/security/cve/CVE-2022-39201"
},
{
"category": "external",
"summary": "SUSE Bug 1204303 for CVE-2022-39201",
"url": "https://bugzilla.suse.com/1204303"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-39201"
},
{
"cve": "CVE-2022-39306",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-39306"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-39306",
"url": "https://www.suse.com/security/cve/CVE-2022-39306"
},
{
"category": "external",
"summary": "SUSE Bug 1205225 for CVE-2022-39306",
"url": "https://bugzilla.suse.com/1205225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-39306"
},
{
"cve": "CVE-2022-39307",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-39307"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a \"user not found\" message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-39307",
"url": "https://www.suse.com/security/cve/CVE-2022-39307"
},
{
"category": "external",
"summary": "SUSE Bug 1205227 for CVE-2022-39307",
"url": "https://bugzilla.suse.com/1205227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-39307"
},
{
"cve": "CVE-2022-39324",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-39324"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker\u0027s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-39324",
"url": "https://www.suse.com/security/cve/CVE-2022-39324"
},
{
"category": "external",
"summary": "SUSE Bug 1207750 for CVE-2022-39324",
"url": "https://bugzilla.suse.com/1207750"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2022-39324"
},
{
"cve": "CVE-2022-41717",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-41717"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-41717",
"url": "https://www.suse.com/security/cve/CVE-2022-41717"
},
{
"category": "external",
"summary": "SUSE Bug 1206135 for CVE-2022-41717",
"url": "https://bugzilla.suse.com/1206135"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2022-41717"
},
{
"cve": "CVE-2023-24534",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-24534"
}
],
"notes": [
{
"category": "general",
"text": "HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-24534",
"url": "https://www.suse.com/security/cve/CVE-2023-24534"
},
{
"category": "external",
"summary": "SUSE Bug 1210127 for CVE-2023-24534",
"url": "https://bugzilla.suse.com/1210127"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2023-24534"
},
{
"cve": "CVE-2023-3128",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-3128"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is validating Azure AD accounts based on the email claim. \n\nOn Azure AD, the profile email field is not unique and can be easily modified. \n\nThis leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-3128",
"url": "https://www.suse.com/security/cve/CVE-2023-3128"
},
{
"category": "external",
"summary": "SUSE Bug 1212641 for CVE-2023-3128",
"url": "https://bugzilla.suse.com/1212641"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 9:grafana-0:9.2.10-7.el9_3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2023-11-07T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2023-3128"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…