CVE-2022-21713

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-21713
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21713.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-21713
Aliases
Downstream
Related
Published
2022-02-08T20:50:17Z
Modified
2026-04-22T03:48:39.122204Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Exposure of Sensitive Information in Grafana
Details

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. /teams/:teamId will allow an authenticated attacker to view unintended data by querying for the specific team ID, /teams/:search will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and /teams/:teamId/members when editorscanadmin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21713.json",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
41f0542c1ec16ce93b336a9f5cf6eef1aba898d0
Fixed
a53fcac7b1b7ebda8c0cb18f7ce92788af92fa32

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21713.json"