CVE catalog

CVE-2022-21702

UBUNTU-CVE-2022-21702

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.34% · Oct 27, 2026

This update for grafana fixes the following issues: Updated to version 8.3.10 (jsc#SLE-24565, jsc#SLE-23422, jsc#SLE-23439): - CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535). - CVE-2022-31107: Fixed OAuth account takeover vulnerability (bsc#1201539). - CVE-2022-21702: Fixed XSS through attacker-controlled data source (bsc#1195726). - CVE-2022-21703: Fixed Cross Site Request Forgery (bsc#1195727). - CVE-2022-21713: Fixed Teams API IDOR (bsc#1195728).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Susegrafanalinux enterprise module for package hub 15 sp48.3.10-150200.3.26.1fixed
Opensusegrafanaleap 15.38.3.10-150200.3.26.1fixed
Opensusegrafanaleap 15.48.3.10-150200.3.26.1fixed
Opensusegrafanatumbleweed8.3.5-1.1fixed
Ubuntugrafana16.042.6.0+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Susegrafanarpmlinux enterprise module for package hub 15 sp48.3.10-150200.3.26.1Not reportedSUSE-SU-2022:3765-1Not reported
Opensusegrafanarpmleap 15.38.3.10-150200.3.26.1Not reportedSUSE-SU-2022:3765-1Not reported
Opensusegrafanarpmleap 15.48.3.10-150200.3.26.1Not reportedSUSE-SU-2022:3765-1Not reported
Opensusegrafanarpmtumbleweed8.3.5-1.1Not reportedOPENSUSE-SU-2024:11836-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [grafana]Fixed

    Source package: [grafana]

    Details (1)

    • 12.4.5-4.1 · x86_64 · tumbleweed

      Fixed · Fixed: 8.3.5-1.1

      pypi · grafana · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]