Detections
Analytics

Alpine: multiple grafana packages: security update to 8.5.9-r0

high Tenable Cloud Security Plugin ID 404808

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch
 prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified
 Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor
 to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10
 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
 (CVE-2022-31097)

 - Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,
 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana
 instance via a configured OAuth IdP which provides a login name to take over the account of another user
 in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via
 OAuth, the malicious user's external user id is not already associated with an account in Grafana, the
 malicious user's email address is not already associated with an account in Grafana, and the malicious
 user knows the Grafana username of the target user. If these conditions are met, the malicious user can
 set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log
 in to Grafana. Due to the way that external and internal user accounts are linked together during login,
 if the conditions above are all met then the malicious user will be able to log in to the target user's
 Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a
 workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users
 authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
 (CVE-2022-31107)

See Also

https://security.alpinelinux.org/vuln/CVE-2022-31097

https://security.alpinelinux.org/vuln/CVE-2022-31107

Plugin Details

Severity: High

ID: 404808

Version: Revision 1.30

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.86

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2022-31097

CVSS v3

Risk Factor: High

Base Score: 8.7

Temporal Score: 7.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/14/2022

Reference Information

CVE: CVE-2022-31097, CVE-2022-31107

IAVB: 2023-B-0087-S