CVE catalog

CVE-2022-39306

UBUNTU-CVE-2022-39306

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.78% · Oct 25, 2026

This update for grafana fixes the following issues: - Version update from 8.5.13 to 8.5.15 (jsc#PED-2617): * CVE-2022-39306: Security fix for privilege escalation (bsc#1205225) * CVE-2022-39307: Omit error from http response when user does not exists (bsc#1205227) * CVE-2022-39201: Do not forward login cookie in outgoing requests (bsc#1204303) * CVE-2022-31130: Make proxy endpoints not leak sensitive HTTP headers (bsc#1204305) * CVE-2022-31123: Fix plugin signature bypass (bsc#1204302) * CVE-2022-39229: Fix blocking other users from signing in (bsc#1204304)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Susegrafanalinux enterprise module for package hub 15 sp48.5.15-150200.3.32.1fixed
Opensusegrafanaleap 15.48.5.15-150200.3.32.1fixed
Opensusegrafanatumbleweed8.5.15-2.1fixed
Ubuntugrafana16.042.6.0+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Susegrafanarpmlinux enterprise module for package hub 15 sp48.5.15-150200.3.32.1Not reportedSUSE-SU-2023:0362-1Not reported
Opensusegrafanarpmleap 15.48.5.15-150200.3.32.1Not reportedSUSE-SU-2023:0362-1Not reported
Opensusegrafanarpmtumbleweed8.5.15-2.1Not reportedOPENSUSE-SU-2024:12564-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [grafana]Fixed

    Source package: [grafana]

    Details (1)

    • 12.4.5-4.1 · x86_64 · tumbleweed

      Fixed · Fixed: 8.5.15-2.1

      pypi · grafana · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]