Количество 13
Количество 13
GHSA-63g3-9jq3-mccv
Grafana API IDOR
CVE-2022-21713
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVE-2022-21713
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVE-2022-21713
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVE-2022-21713
Grafana is an open-source platform for monitoring and observability. A ...
SUSE-SU-2022:3765-1
Security update for grafana
SUSE-SU-2022:1396-1
Security update for SUSE Manager Client Tools
SUSE-FU-2022:1419-1
Feature update for grafana
SUSE-SU-2022:2134-1
Security update for SUSE Manager Client Tools
RLSA-2022:8057
Important: grafana security, bug fix, and enhancement update
RLSA-2022:7519
Moderate: grafana security, bug fix, and enhancement update
ELSA-2022-8057
ELSA-2022-8057: grafana security, bug fix, and enhancement update (IMPORTANT)
ELSA-2022-7519
ELSA-2022-7519: grafana security, bug fix, and enhancement update (MODERATE)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-63g3-9jq3-mccv Grafana API IDOR | CVSS3: 4.3 | 0% Низкий | около 1 года назад |
 | CVE-2022-21713 Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
 | CVE-2022-21713 Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
 | CVE-2022-21713 Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
| CVE-2022-21713 Grafana is an open-source platform for monitoring and observability. A ... | CVSS3: 4.3 | 0% Низкий | больше 3 лет назад |
 | SUSE-SU-2022:3765-1 Security update for grafana | больше 2 лет назад | ||
| SUSE-SU-2022:1396-1 Security update for SUSE Manager Client Tools | около 3 лет назад | ||
| SUSE-FU-2022:1419-1 Feature update for grafana | около 3 лет назад | ||
| SUSE-SU-2022:2134-1 Security update for SUSE Manager Client Tools | почти 3 года назад | ||
 | RLSA-2022:8057 Important: grafana security, bug fix, and enhancement update | больше 2 лет назад | ||
| RLSA-2022:7519 Moderate: grafana security, bug fix, and enhancement update | больше 2 лет назад | ||
| ELSA-2022-8057 ELSA-2022-8057: grafana security, bug fix, and enhancement update (IMPORTANT) | больше 2 лет назад | ||
| ELSA-2022-7519 ELSA-2022-7519: grafana security, bug fix, and enhancement update (MODERATE) | больше 2 лет назад |
Уязвимостей на страницу