CVE-2022-21703

Description

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Weakness classification

• security-advisories@github.com: CWE-352
• nvd@nist.gov: CWE-352

Primary references

• security-advisories@github.com — Issue Tracking, Patch, Third Party Advisory
• security-advisories@github.com — Mitigation, Release Notes, Third Party Advisory
• security-advisories@github.com — Mitigation, Release Notes, Vendor Advisory
• security-advisories@github.com
• security-advisories@github.com
• security-advisories@github.com
• security-advisories@github.com — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108