Oval Definition:oval:org.opensuse.security:def:202221673
Revision Date:2022-09-02Version:1
Title:CVE-2022-21673
Description:

Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4.
Family:unixClass:vulnerability
Status:Reference(s):Mitre CVE-2022-21673
SUSE CVE-2022-21673
SUSE-SU-2022:0751-1
SUSE-SU-2022:1396-1
SUSE-CU-2022:878-1
SUSE-SU-2022:2134-1
Platform(s):openSUSE Leap 15.3
openSUSE Leap 15.4
openSUSE Tumbleweed
SUSE Linux Enterprise Module for SUSE Manager Server 4.2
SUSE Linux Enterprise Server 12 SP4-ESPOS
SUSE Linux Enterprise Server 12 SP4-LTSS
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP4
SUSE Linux Enterprise Server for SAP Applications 12 SP5
SUSE Manager Server 4.2
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Product(s):
Definition Synopsis
  • Release Information
  • SUSE Linux Enterprise Module for SUSE Manager Server 4.2 is installed
  • OR SUSE Manager Server 4.2 is installed
  • AND prometheus-postgres_exporter-0.10.0-150000.1.3.1 is installed
    • Definition Synopsis
  • Release Information
  • SUSE OpenStack Cloud 8 is installed
  • OR SUSE OpenStack Cloud Crowbar 8 is installed
  • AND grafana is affected
    • Definition Synopsis
  • Release Information
  • SUSE OpenStack Cloud 9 is installed
  • OR SUSE OpenStack Cloud Crowbar 9 is installed
  • AND grafana is affected
    • Definition Synopsis
  • openSUSE Leap 15.4 is installed
  • AND Package Information
  • grafana-8.3.5-150200.3.21.1 is installed
  • AND grafana is signed with openSUSE key
    • Definition Synopsis
  • openSUSE Tumbleweed is installed
  • AND grafana-8.3.4-1.1 is installed
    • Definition Synopsis
  • openSUSE Leap 15.3 is installed
  • AND Package Information
  • grafana-8.3.5-150200.3.21.1 is installed
  • AND grafana is signed with openSUSE key
  • OR
  • prometheus-postgres_exporter-0.10.0-150000.1.3.1 is installed
  • AND prometheus-postgres_exporter is signed with openSUSE key
  • OR
  • python3-rhnlib-4.2.6-150000.3.34.1 is installed
  • AND python3-rhnlib is signed with openSUSE key
  • OR
  • spacecmd-4.2.16-150000.3.77.1 is installed
  • AND spacecmd is signed with openSUSE key
    • Definition Synopsis
  • Release Information
  • SUSE Linux Enterprise Server 12 SP5 is installed
  • OR SUSE Linux Enterprise Server for SAP Applications 12 SP5 is installed
  • AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed
    • Definition Synopsis
  • Release Information
  • SUSE Linux Enterprise Server for SAP Applications 12 SP4 is installed
  • AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed
  • OR Package Information
  • SUSE Linux Enterprise Server 12 SP4-LTSS is installed
  • AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed
  • OR Package Information
  • SUSE Linux Enterprise Server 12 SP4-ESPOS is installed
  • AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed
    • BACK