CVE-2022-39201

 

Published at: - 14-10-2022 01:15

Last modified: - 19-10-2022 04:59

Total changes: - 3

Description

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr
• https://github.com/grafana/grafana/releases/tag/v9.1.8
• https://github.com/grafana/grafana/commit/c658816f5229d17f877579250c07799d3bbaebc9
• https://github.com/grafana/grafana/commit/b571acc1dc130a33f24742c1f93b93216da6cf57

 

Keywords

NVD

 

CVE-2022-39201

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures