vulnerability

FreeBSD: VID-6877e164-6296-11ed-9ca2-6c3be5272acd (CVE-2022-39201): Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins

Severity
8
CVSS
(AV:N/AC:M/Au:M/C:C/I:C/A:C)
Published
Nov 12, 2022
Added
Nov 13, 2022
Modified
Dec 10, 2025

Description

Grafana Labs reports: On September 7th as a result of an internal security audit we have discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis the vulnerability impacts data source and plugin proxy endpoints under certain conditions. We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)

Solutions

freebsd-upgrade-package-grafanafreebsd-upgrade-package-grafana7freebsd-upgrade-package-grafana8freebsd-upgrade-package-grafana9
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.