Homepage
About Snyk

Cross-site Request Forgery (CSRF) Affecting grafana package, versions <8.3.6-r0

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.32% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ALPINE320-GRAFANA-7011843
  • published 23 May 2024
  • disclosed 8 Feb 2022
Report a new vulnerability Found a mistake?

Introduced: 8 Feb 2022

CVE-2022-21703 Open this link in a new tab
CWE-352 Open this link in a new tab

How to fix?

Upgrade Alpine:3.20 grafana to version 8.3.6-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

References

CVSS Scores

version 3.1
Expand this section

NVD

Recommended
8.8 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

SUSE

6.8 medium
Expand this section

Red Hat

6.8 medium