REDHAT-BUG-2131146
First published: Fri Sep 30 2022(Updated: )
CVE-2022-31130: Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins A security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis the vulnerability impacts data source and plugin proxy endpoints with authentication tokens, as a result the destination plugin could receive a Grafana authentication token of the user. Affected versions: Grafana <= 9.1.x
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grafana Image Renderer | <=9.1.x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2131146?
The severity of REDHAT-BUG-2131146 is classified as high due to the potential exposure of sensitive authentication tokens.
How do I fix REDHAT-BUG-2131146?
To fix REDHAT-BUG-2131146, update Grafana to a version higher than 9.1.x that addresses the vulnerability.
Which software is affected by REDHAT-BUG-2131146?
REDHAT-BUG-2131146 affects Grafana versions up to and including 9.1.x, specifically the GitLab data source plugin.
What kind of data is at risk with REDHAT-BUG-2131146?
REDHAT-BUG-2131146 puts API keys and authentication tokens at risk of being leaked to unauthorized plugins.
Who reported the vulnerability identified by REDHAT-BUG-2131146?
The vulnerability identified by REDHAT-BUG-2131146 was reported by a security researcher to Grafana Labs.
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-31130
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/grafana labs
- canonical/grafana image renderer