The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3765-1 advisory.

  - Grafana is an open-source platform for monitoring and observability. In affected versions an attacker     could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML     page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could     either compromise an existing datasource for a specific Grafana instance or either set up its own public     service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following     must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as     Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above     datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked     on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled     with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a     specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated     user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a     compromised plugin through a crafted link. Users are advised to update to a patched version. There are no     known workarounds for this vulnerability. (CVE-2022-21702)

  - Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a     cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting     cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins).
    An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into     inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as     possible. There are no known workarounds for this issue. (CVE-2022-21703)

  - Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose     multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an     authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will     allow an authenticated attacker to search for teams and see the total number of available teams, including     for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin     flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID.
    Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
    (CVE-2022-21713)

  - Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch     prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified     Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor     to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10     contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
    (CVE-2022-31097)

  - Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,     8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana     instance via a configured OAuth IdP which provides a login name to take over the account of another user     in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via     OAuth, the malicious user's external user id is not already associated with an account in Grafana, the     malicious user's email address is not already associated with an account in Grafana, and the malicious     user knows the Grafana username of the target user. If these conditions are met, the malicious user can     set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log     in to Grafana. Due to the way that external and internal user accounts are linked together during login,     if the conditions above are all met then the malicious user will be able to log in to the target user's     Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a     workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users     authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
    (CVE-2022-31107)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : grafana (SUSE-SU-2022:3765-1)

high Nessus Plugin ID 166603

Version 1.8

Version 1.7

Version 1.6

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.8 Feb 16, 2024, 12:17 PM IAVM reference Plugin Feed: 202402161217
Version 1.7 Nov 3, 2023, 11:50 AM IAVM reference STIG Severity (set to "I") Plugin Feed: 202311031150
Version 1.6 Jul 14, 2023, 7:08 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection Plugin metadata Plugin Feed: 202307140708
Version 1.6 Nov 3, 2023, 10:02 AM IAVM reference STIG Severity (set to "I") Plugin Feed: 202311031002
Version 1.5 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.5 Jul 14, 2023, 5:13 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection Plugin metadata Plugin Feed: 202307140513
Version 1.4 Feb 8, 2023, 11:19 PM Logic Changes (Updated openSUSE package checks in SUSE plugins) Plugin Feed: 202302082319
Version 1.3 Jan 21, 2023, 5:26 AM Logic Changes (Added package checks for openSuSE) Plugin Feed: 202301210526