Bug 2044628 (CVE-2022-21673)
Summary: | CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Todd Cullum <tcullum> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | agerstmayr, amctagga, amuller, anharris, anpicker, aos-bugs, bdettelb, bmontgom, bniver, crarobin, eparis, erooth, fjansen, flucifre, gmeno, gparvin, grafana-maint, hvyas, jburrell, jkurik, jmadigan, jokerman, jramanat, jwendell, mbenjamin, mhackett, nathans, ngough, njean, nstielau, pahickey, pamccart, rcernich, sostapov, spasquie, sponnaga, stcannon, twalsh, vereddy, vkumar |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | grafana 8.3.4, grafana 7.5.13 | Doc Type: | If docs needed, set a value |
Doc Text: |
An information-disclosure flaw was found in grafana. When a data source has the Forward OAuth Identity feature enabled, sending a query to that data source with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This flaw allows API token holders to retrieve data to which they may not be authorized.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2022-03-10 21:31:15 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2046614, 2046615, 2046616, 2050685, 2054912, 2054913 | ||
Bug Blocks: | 2044623 |
Description
Todd Cullum
2022-01-24 20:43:43 UTC
Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2046615] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.10 Via RHSA-2022:0056 https://access.redhat.com/errata/RHSA-2022:0056 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-21673 This issue has been addressed in the following products: Red Hat Ceph Storage 5.2 Via RHSA-2022:6024 https://access.redhat.com/errata/RHSA-2022:6024 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7519 https://access.redhat.com/errata/RHSA-2022:7519 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057 |