Information Exposure Affecting grafana package, versions <0:9.2.10-7.el9_3.alma.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-GRAFANA-6062093
- published 15 Nov 2023
- disclosed 7 Nov 2023
Introduced: 7 Nov 2023
CVE-2022-39307 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:9 grafana to version 0:9.2.10-7.el9_3.alma.1 or higher.
This issue was patched in ALSA-2023:6420.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:9 relevant fixed versions and status.
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.