CVE-2022-21703
Description
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Risk Information
Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
1.869
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2022-21703 are affected in GrafanaEnterprise 3.0.0 | Windows |
| (RHSA-2022:8057) grafana security, bug fix, and enhancement update grafana-7.5.15-3.el9.x86_64.rpm | Linux |
| grafana security, bug fix, and enhancement update (RLSA-2022:7519) grafana-7.5.15-3.el8.x86_64.rpm | Linux |
| grafana security, bug fix, and enhancement update (RLSA-2022:8057) grafana-7.5.15-3.el9.x86_64.rpm | Linux |
| Grafana update (ELSA-2023-6420) grafana-9.2.10-7.el9_3.x86_64.rpm | Linux |
| Grafana update (ELSA-2023-6972) grafana-9.2.10-7.el8_9.x86_64.rpm | Linux |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-335779 | GrafanaEnterprise (10.3.1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234