CVE-2022-31130 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-31130 Interim 1 9 2023-09-08T23:28:54Z current 2022-10-15T14:50:33Z 2023-09-08T23:28:54Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-31130 Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2023-March/013936.html E-Mail link for SUSE-CU-2023:498-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013729.html E-Mail link for SUSE-SU-2023:0352-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013725.html E-Mail link for SUSE-SU-2023:0353-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013726.html E-Mail link for SUSE-SU-2023:0362-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container ses/7.1/ceph/grafana:8.5.15.2.2.393 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Manager Tools 12 SUSE Manager Tools 15 SUSE Manager Tools for SLE Micro 5 openSUSE Leap 15.4 openSUSE Tumbleweed dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 grafana grafana-8.5.14-1.1 grafana-8.5.15-1.39.1 grafana-8.5.15-150000.1.39.1 grafana-8.5.15-150200.3.32.1 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 mgr-osad-4.3.7-1.42.1 mgr-osad-4.3.7-150000.1.42.1 mgr-push-4.3.5-1.24.1 mgr-push-4.3.5-150000.1.24.2 python2-mgr-osa-common-4.3.7-1.42.1 python2-mgr-osad-4.3.7-1.42.1 python2-mgr-push-4.3.5-1.24.1 python2-rhnlib-4.3.5-21.46.1 python2-spacewalk-check-4.3.14-52.83.1 python2-spacewalk-client-setup-4.3.14-52.83.1 python2-spacewalk-client-tools-4.3.14-52.83.1 python2-uyuni-common-libs-4.3.7-1.30.1 python3-mgr-osa-common-4.3.7-150000.1.42.1 python3-mgr-osad-4.3.7-150000.1.42.1 python3-mgr-push-4.3.5-150000.1.24.2 python3-rhnlib-4.3.5-150000.3.40.1 python3-spacewalk-check-4.3.14-150000.3.74.1 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 python3-uyuni-common-libs-4.3.7-150000.1.30.1 spacecmd-4.3.18-150000.3.92.1 spacecmd-4.3.18-38.115.1 spacewalk-check-4.3.14-150000.3.74.1 spacewalk-check-4.3.14-52.83.1 spacewalk-client-setup-4.3.14-150000.3.74.1 spacewalk-client-setup-4.3.14-52.83.1 spacewalk-client-tools-4.3.14-150000.3.74.1 spacewalk-client-tools-4.3.14-52.83.1 grafana-8.5.15-150200.3.32.1 as a component of Container ses/7.1/ceph/grafana:8.5.15.2.2.393 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 grafana-8.5.15-1.39.1 as a component of SUSE Manager Tools 12 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 as a component of SUSE Manager Tools 12 mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-mgr-osa-common-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-rhnlib-4.3.5-21.46.1 as a component of SUSE Manager Tools 12 python2-spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-uyuni-common-libs-4.3.7-1.30.1 as a component of SUSE Manager Tools 12 spacecmd-4.3.18-38.115.1 as a component of SUSE Manager Tools 12 spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools 15 grafana-8.5.15-150000.1.39.1 as a component of SUSE Manager Tools 15 mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-mgr-osa-common-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-rhnlib-4.3.5-150000.3.40.1 as a component of SUSE Manager Tools 15 python3-spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-uyuni-common-libs-4.3.7-150000.1.30.1 as a component of SUSE Manager Tools 15 spacecmd-4.3.18-150000.3.92.1 as a component of SUSE Manager Tools 15 spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools for SLE Micro 5 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of openSUSE Leap 15.4 grafana-8.5.15-150200.3.32.1 as a component of openSUSE Leap 15.4 spacecmd-4.3.18-150000.3.92.1 as a component of openSUSE Leap 15.4 grafana-8.5.14-1.1 as a component of openSUSE Tumbleweed grafana as a component of SUSE Enterprise Storage 6 Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication. CVE-2022-31130 Container ses/7.1/ceph/grafana:8.5.15.2.2.393:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python2-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python3-mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:spacecmd-4.3.18-150000.3.92.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Manager Tools 12:grafana-8.5.15-1.39.1 SUSE Manager Tools 12:kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 SUSE Manager Tools 12:mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-mgr-osa-common-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-rhnlib-4.3.5-21.46.1 SUSE Manager Tools 12:python2-spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 12:python2-uyuni-common-libs-4.3.7-1.30.1 SUSE Manager Tools 12:spacecmd-4.3.18-38.115.1 SUSE Manager Tools 12:spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 15:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Manager Tools 15:grafana-8.5.15-150000.1.39.1 SUSE Manager Tools 15:mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-mgr-osa-common-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-rhnlib-4.3.5-150000.3.40.1 SUSE Manager Tools 15:python3-spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Manager Tools 15:spacecmd-4.3.18-150000.3.92.1 SUSE Manager Tools 15:spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools for SLE Micro 5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:grafana-8.5.15-150200.3.32.1 openSUSE Leap 15.4:spacecmd-4.3.18-150000.3.92.1 openSUSE Tumbleweed:grafana-8.5.14-1.1 SUSE Enterprise Storage 6:grafana moderate 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N