Homepage
About Snyk

Cross-site Request Forgery (CSRF) Affecting grafana package, versions <0:7.5.15-3.el8

Severity

 Recommended
0.0
medium
0
10

Based on CentOS security rating

    Threat Intelligence

    EPSS
    0.32% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-CENTOS8-GRAFANA-2400131
  • published 12 Feb 2022
  • disclosed 8 Feb 2022
Report a new vulnerability Found a mistake?

Introduced: 8 Feb 2022

CVE-2022-21703 Open this link in a new tab
CWE-352 Open this link in a new tab

How to fix?

Upgrade Centos:8 grafana to version 0:7.5.15-3.el8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

References

CVSS Scores

version 3.1
Expand this section

NVD

8.8 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

Red Hat

6.8 medium
Expand this section

SUSE

6.8 medium