Bug 2131148 (CVE-2022-39201)

Summary: CVE-2022-39201 grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agerstmayr, anstephe, aoconnor, avibelli, bgeorges, bniver, chazlett, clement.escoffier, dandread, dkreling, flucifre, gmeno, go-sig, gparvin, grafana-maint, gsmet, jburrell, jkurik, jochrist, jwon, lthon, mbenjamin, mhackett, nathans, njean, pahickey, peholase, pgallagh, pjindal, probinso, rruss, rsvoboda, sbiarozk, sdouglas, sostapov, stcannon, vereddy, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Grafana. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. Grafana could leak the authentication cookie of users to plugins, which could result in an impact to confidentiality, integrity, and availability.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2131262, 2131189, 2131190, 2133062, 2133063, 2133064, 2134706, 2134937    
Bug Blocks: 2131159    

Description TEJ RATHI 2022-09-30 05:51:39 UTC
CVE-2022-39201: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions.

Affected versions: Grafana <= 9.1.x

Comment 4 Marian Rehak 2022-10-14 05:37:40 UTC
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2134706]

Comment 16 errata-xmlrpc 2023-06-15 16:01:07 UTC
This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642

Comment 18 errata-xmlrpc 2023-11-07 08:16:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6420 https://access.redhat.com/errata/RHSA-2023:6420