CVE-2022-21713

Exposure of Sensitive Information in Grafana

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Las versiones afectadas de Grafana exponen varios endpoints de la API que no manejan apropiadamente la autorización del usuario. El punto API "/teams/:teamId" permitirá a un atacante autenticado visualizar datos no deseados al consultar por el ID del equipo específico, "/teams/:search" permitirá a un atacante autenticado buscar equipos y visualizar el número total de equipos disponibles, incluyendo aquellos equipos a los que el usuario no presenta acceso, y "/teams/:teamId/members" cuando el flag editors_can_admin está habilitada, un atacante autenticado puede visualizar datos no deseados al consultar por el ID del equipo específico. Se recomienda a usuarios actualizar lo antes posible. No hay medidas de mitigación adicionales conocidas para este problema

An Insecure Direct Object Reference (IDOR) vulnerability was found on Grafana Teams APIs. This flaw impacts the `/teams/:teamId`, `/teams/:search`, `/teams/:teamId/members` API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for teams and see the total number of available teams (including teams that the user does not have access to).

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-16 CVE Reserved
2022-02-08 CVE Published
2024-05-14 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-425: Direct Request ('Forced Browsing')
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-863: Incorrect Authorization

CAPEC

References (9)

URL	Tag	Source
https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv	Release Notes
https://security.netapp.com/advisory/ntap-20220303-0005	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/grafana/grafana/pull/45083	2023-11-07

URL	Date	SRC
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ	2023-11-07
https://access.redhat.com/security/cve/CVE-2022-21713	2022-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=2050743	2022-11-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 5.0.0 < 7.5.15 Search vendor "Grafana" for product "Grafana" and version " >= 5.0.0 < 7.5.15"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				>= 8.0.0 < 8.3.5 Search vendor "Grafana" for product "Grafana" and version " >= 8.0.0 < 8.3.5"		-		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				5.0.0 Search vendor "Grafana" for product "Grafana" and version "5.0.0"		beta1		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				5.0.0 Search vendor "Grafana" for product "Grafana" and version "5.0.0"		beta2		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				5.0.0 Search vendor "Grafana" for product "Grafana" and version "5.0.0"		beta3		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				5.0.0 Search vendor "Grafana" for product "Grafana" and version "5.0.0"		beta4		Affected
Grafana Search vendor "Grafana"		Grafana Search vendor "Grafana" for product "Grafana"				5.0.0 Search vendor "Grafana" for product "Grafana" and version "5.0.0"		beta5		Affected
Netapp Search vendor "Netapp"		E-series Performance Analyzer Search vendor "Netapp" for product "E-series Performance Analyzer"				< 3.0 Search vendor "Netapp" for product "E-series Performance Analyzer" and version " < 3.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				36 Search vendor "Fedoraproject" for product "Fedora" and version "36"		-		Affected