Vulnerability · Published Feb 8, 2022 · Assigned by GitHub_M

CVE-2022-21703Cross Site Request Forgery in Grafana

Medium 6.3

In plain English

A medium-severity cross-site request forgery in grafana from grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)2.3%top 16.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	grafana	7.5.15-3.el8	ALSA-2022:7519
AlmaLinux:9	grafana	7.5.15-3.el9	ALSA-2022:8057
Alpine:v3.20	grafana	8.3.6-r0	ALPINE-CVE-2022-21703
Alpine:v3.21	grafana	8.3.6-r0	ALPINE-CVE-2022-21703
Alpine:v3.22	grafana	8.3.6-r0	ALPINE-CVE-2022-21703
Alpine:v3.23	grafana	8.3.6-r0	ALPINE-CVE-2022-21703
Alpine:v3.24	grafana	8.3.6-r0	ALPINE-CVE-2022-21703
Go	github.com/grafana/grafana/pkg/web	7.5.15	GHSA-cmf4-h3xc-jw8w
Go	github.com/grafana/grafana/pkg/web	8.3.5	GHSA-cmf4-h3xc-jw8w
Rocky Linux:8	grafana	0:7.5.15-3.el8	RLSA-2022:7519
Rocky Linux:9	grafana	0:7.5.15-3.el9	RLSA-2022:8057

Affected products (as reported)

Vendor	Product	Versions
grafana	grafana	>= 3.0-beta1, < 7.5.15>= 8.0.0, < 8.3.5

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

References

https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/ x_refsource_MISC
https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w x_refsource_CONFIRM
https://github.com/grafana/grafana/pull/45083 x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220303-0005/ x_refsource_CONFIRM
FEDORA-2022-83405f9d5b vendor-advisory, x_refsource_FEDORA
FEDORA-2022-9dd03cab55 vendor-advisory, x_refsource_FEDORA
FEDORA-2022-c5383675d9 vendor-advisory, x_refsource_FEDORA