CVE-2022-36062

描述

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.

如何修補 CVE-2022-36062

要修補 CVE-2022-36062,請將受影響套件升級到下列已修補版本。

• —升級至 8.5.13 或更新版本
• —升級至 8.5.13 或更新版本
• —未列出修補版本

CVE-2022-36062 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 8.5.13, >= 9.0.0, < 9.0.9, >= 9.1.0, < 9.1.6
• >= 8.5.0, < 8.5.13
• from 0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-36062
• PATCHgithub.com/grafana/grafana
• WEBgithub.com/grafana/grafana/security/advisories/GHSA-p978-56hq-r492
• WEBsecurity.netapp.com/advisory/ntap-20221215-0001
• WEB