CVE-2022-39307 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-39307 Interim 1 9 2023-09-08T23:26:07Z current 2022-11-10T00:43:03Z 2023-09-08T23:26:07Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-39307 Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2023-March/013936.html E-Mail link for SUSE-CU-2023:498-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013729.html E-Mail link for SUSE-SU-2023:0352-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013725.html E-Mail link for SUSE-SU-2023:0353-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013726.html E-Mail link for SUSE-SU-2023:0362-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container ses/7.1/ceph/grafana:8.5.15.2.2.393 HPE Helion OpenStack 8 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Manager Client Tools Beta for SLE 12 SUSE Manager Tools 12 SUSE Manager Tools 15 SUSE Manager Tools for SLE Micro 5 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Leap 15.4 openSUSE Tumbleweed dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 grafana grafana-8.5.15-1.1 grafana-8.5.15-1.39.1 grafana-8.5.15-150000.1.39.1 grafana-8.5.15-150200.3.32.1 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 mgr-osad-4.3.7-1.42.1 mgr-osad-4.3.7-150000.1.42.1 mgr-push-4.3.5-1.24.1 mgr-push-4.3.5-150000.1.24.2 python2-mgr-osa-common-4.3.7-1.42.1 python2-mgr-osad-4.3.7-1.42.1 python2-mgr-push-4.3.5-1.24.1 python2-rhnlib-4.3.5-21.46.1 python2-spacewalk-check-4.3.14-52.83.1 python2-spacewalk-client-setup-4.3.14-52.83.1 python2-spacewalk-client-tools-4.3.14-52.83.1 python2-uyuni-common-libs-4.3.7-1.30.1 python3-mgr-osa-common-4.3.7-150000.1.42.1 python3-mgr-osad-4.3.7-150000.1.42.1 python3-mgr-push-4.3.5-150000.1.24.2 python3-rhnlib-4.3.5-150000.3.40.1 python3-spacewalk-check-4.3.14-150000.3.74.1 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 python3-uyuni-common-libs-4.3.7-150000.1.30.1 spacecmd-4.3.18-150000.3.92.1 spacecmd-4.3.18-38.115.1 spacewalk-check-4.3.14-150000.3.74.1 spacewalk-check-4.3.14-52.83.1 spacewalk-client-setup-4.3.14-150000.3.74.1 spacewalk-client-setup-4.3.14-52.83.1 spacewalk-client-tools-4.3.14-150000.3.74.1 spacewalk-client-tools-4.3.14-52.83.1 grafana-8.5.15-150200.3.32.1 as a component of Container ses/7.1/ceph/grafana:8.5.15.2.2.393 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 grafana-8.5.15-150200.3.32.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 grafana-8.5.15-1.39.1 as a component of SUSE Manager Tools 12 kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 as a component of SUSE Manager Tools 12 mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-mgr-osa-common-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-osad-4.3.7-1.42.1 as a component of SUSE Manager Tools 12 python2-mgr-push-4.3.5-1.24.1 as a component of SUSE Manager Tools 12 python2-rhnlib-4.3.5-21.46.1 as a component of SUSE Manager Tools 12 python2-spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 python2-uyuni-common-libs-4.3.7-1.30.1 as a component of SUSE Manager Tools 12 spacecmd-4.3.18-38.115.1 as a component of SUSE Manager Tools 12 spacewalk-check-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-setup-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 spacewalk-client-tools-4.3.14-52.83.1 as a component of SUSE Manager Tools 12 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools 15 grafana-8.5.15-150000.1.39.1 as a component of SUSE Manager Tools 15 mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-mgr-osa-common-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-osad-4.3.7-150000.1.42.1 as a component of SUSE Manager Tools 15 python3-mgr-push-4.3.5-150000.1.24.2 as a component of SUSE Manager Tools 15 python3-rhnlib-4.3.5-150000.3.40.1 as a component of SUSE Manager Tools 15 python3-spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 python3-uyuni-common-libs-4.3.7-150000.1.30.1 as a component of SUSE Manager Tools 15 spacecmd-4.3.18-150000.3.92.1 as a component of SUSE Manager Tools 15 spacewalk-check-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-setup-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 spacewalk-client-tools-4.3.14-150000.3.74.1 as a component of SUSE Manager Tools 15 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of SUSE Manager Tools for SLE Micro 5 dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 as a component of openSUSE Leap 15.4 grafana-8.5.15-150200.3.32.1 as a component of openSUSE Leap 15.4 spacecmd-4.3.18-150000.3.92.1 as a component of openSUSE Leap 15.4 grafana-8.5.15-1.1 as a component of openSUSE Tumbleweed grafana as a component of HPE Helion OpenStack 8 grafana as a component of SUSE Manager Client Tools Beta for SLE 12 grafana as a component of SUSE OpenStack Cloud 8 grafana as a component of SUSE OpenStack Cloud 9 grafana as a component of SUSE OpenStack Cloud Crowbar 8 grafana as a component of SUSE OpenStack Cloud Crowbar 9 Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds. CVE-2022-39307 Container ses/7.1/ceph/grafana:8.5.15.2.2.393:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python2-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python3-mgr-osa-dispatcher-4.3.7-150000.1.42.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:spacecmd-4.3.18-150000.3.92.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:grafana-8.5.15-150200.3.32.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:grafana-8.5.15-150200.3.32.1 SUSE Manager Tools 12:grafana-8.5.15-1.39.1 SUSE Manager Tools 12:kiwi-desc-saltboot-0.1.1673279145.e7616bd-1.32.1 SUSE Manager Tools 12:mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-mgr-osa-common-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-osad-4.3.7-1.42.1 SUSE Manager Tools 12:python2-mgr-push-4.3.5-1.24.1 SUSE Manager Tools 12:python2-rhnlib-4.3.5-21.46.1 SUSE Manager Tools 12:python2-spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:python2-spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 12:python2-uyuni-common-libs-4.3.7-1.30.1 SUSE Manager Tools 12:spacecmd-4.3.18-38.115.1 SUSE Manager Tools 12:spacewalk-check-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-setup-4.3.14-52.83.1 SUSE Manager Tools 12:spacewalk-client-tools-4.3.14-52.83.1 SUSE Manager Tools 15:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 SUSE Manager Tools 15:grafana-8.5.15-150000.1.39.1 SUSE Manager Tools 15:mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-mgr-osa-common-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-osad-4.3.7-150000.1.42.1 SUSE Manager Tools 15:python3-mgr-push-4.3.5-150000.1.24.2 SUSE Manager Tools 15:python3-rhnlib-4.3.5-150000.3.40.1 SUSE Manager Tools 15:python3-spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools 15:python3-uyuni-common-libs-4.3.7-150000.1.30.1 SUSE Manager Tools 15:spacecmd-4.3.18-150000.3.92.1 SUSE Manager Tools 15:spacewalk-check-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-setup-4.3.14-150000.3.74.1 SUSE Manager Tools 15:spacewalk-client-tools-4.3.14-150000.3.74.1 SUSE Manager Tools for SLE Micro 5:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:dracut-saltboot-0.1.1673279145.e7616bd-150000.1.44.1 openSUSE Leap 15.4:grafana-8.5.15-150200.3.32.1 openSUSE Leap 15.4:spacecmd-4.3.18-150000.3.92.1 openSUSE Tumbleweed:grafana-8.5.15-1.1 HPE Helion OpenStack 8:grafana SUSE Manager Client Tools Beta for SLE 12:grafana SUSE OpenStack Cloud 8:grafana SUSE OpenStack Cloud 9:grafana SUSE OpenStack Cloud Crowbar 8:grafana SUSE OpenStack Cloud Crowbar 9:grafana moderate 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N