REDHAT-BUG-2131146: Medium severity grafana image renderer vulnerability
CVE-2022-31130: Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
A security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis the vulnerability impacts data source and plugin proxy endpoints with authentication tokens, as a result the destination plugin could receive a Grafana authentication token of the user.
Affected versions: Grafana <= 9.1.x
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2131146?
The severity of REDHAT-BUG-2131146 is classified as high due to the potential exposure of sensitive authentication tokens.
How do I fix REDHAT-BUG-2131146?
To fix REDHAT-BUG-2131146, update Grafana to a version higher than 9.1.x that addresses the vulnerability.
Which software is affected by REDHAT-BUG-2131146?
REDHAT-BUG-2131146 affects Grafana versions up to and including 9.1.x, specifically the GitLab data source plugin.
What kind of data is at risk with REDHAT-BUG-2131146?
REDHAT-BUG-2131146 puts API keys and authentication tokens at risk of being leaked to unauthorized plugins.
Who reported the vulnerability identified by REDHAT-BUG-2131146?
The vulnerability identified by REDHAT-BUG-2131146 was reported by a security researcher to Grafana Labs.