CVE-2022-21702 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-21702 Interim 1 54 2025-12-23T02:53:51Z current 2022-02-10T02:50:32Z 2025-12-23T02:53:51Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-21702 Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2022-September/012142.html E-Mail link for SUSE-CU-2022:2083-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012818.html E-Mail link for SUSE-CU-2022:2809-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/010952.html E-Mail link for SUSE-CU-2022:878-1 https://lists.suse.com/pipermail/sle-updates/2022-April/022823.html E-Mail link for SUSE-FU-2022:1419-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010387.html E-Mail link for SUSE-SU-2022:0751-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010822.html E-Mail link for SUSE-SU-2022:1396-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011316.html E-Mail link for SUSE-SU-2022:2134-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012594.html E-Mail link for SUSE-SU-2022:3676-1 https://lists.suse.com/pipermail/sle-security-updates/2022-October/012701.html E-Mail link for SUSE-SU-2022:3765-1 https://lists.suse.com/pipermail/sle-security-updates/2024-January/017744.html E-Mail link for SUSE-SU-2024:0191-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container ses/7.1/ceph/grafana:8.3.10.2.2.285 Container ses/7/ceph/grafana:8.3.5.3.778 Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 HPE Helion OpenStack 8 Image server-image SUSE Enterprise Storage 6 SUSE Liberty Linux 8 SUSE Liberty Linux 9 SUSE Linux Enterprise Module for Package Hub 15 SP4 SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP6 SUSE Linux Enterprise Module for Package Hub 15 SP7 SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-ESPOS SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP3-TERADATA SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Manager Client Tools 12 SUSE Manager Client Tools 12-BETA SUSE Manager Client Tools 15 SUSE Manager Server Module 4.2 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed golang-github-QubitProducts-exporter_exporter-0.4.0-1.6.1 golang-github-QubitProducts-exporter_exporter-0.4.0-4.6.2 golang-github-boynux-squid_exporter-1.6-4.9.2 golang-github-lusitaniae-apache_exporter-1.0.0-4.12.4 golang-github-prometheus-alertmanager-0.23.0-1.12.3 golang-github-prometheus-alertmanager-0.26.0-4.12.4 golang-github-prometheus-node_exporter-1.3.0-1.15.3 golang-github-prometheus-node_exporter-1.5.0-4.15.4 golang-github-prometheus-prometheus-2.45.0-4.33.3 golang-github-prometheus-promu-0.14.0-4.12.2 grafana-7.5.15-3.el8 grafana-7.5.15-3.el9 grafana-8.3.10-150200.3.26.1 grafana-8.3.5-1.1 grafana-8.3.5-1.30.3 grafana-8.3.5-150000.1.30.1 grafana-8.3.5-150200.3.21.1 grafana-8.5.13-150100.3.12.1 grafana-9.5.8-4.21.2 kiwi-desc-saltboot-0.1.1687520761.cefb248-4.15.2 mgr-cfg-4.2.8-150000.1.24.1 mgr-cfg-4.3.6-1.27.4 mgr-cfg-actions-4.2.8-150000.1.24.1 mgr-cfg-actions-4.3.6-1.27.4 mgr-cfg-client-4.2.8-150000.1.24.1 mgr-cfg-client-4.3.6-1.27.4 mgr-cfg-management-4.2.8-150000.1.24.1 mgr-cfg-management-4.3.6-1.27.4 mgr-custom-info-4.3.3-1.18.1 mgr-daemon-4.3.4-1.32.3 mgr-osad-4.2.8-150000.1.36.1 mgr-osad-4.3.6-1.39.4 mgr-push-4.2.5-150000.1.18.2 mgr-push-4.3.4-1.21.4 mgr-push-5.0.1-4.21.4 mgr-virtualization-host-4.2.4-150000.1.26.1 mgr-virtualization-host-4.3.5-1.29.3 prometheus-blackbox_exporter-0.19.0-1.8.2 prometheus-blackbox_exporter-0.24.0-3.6.3 prometheus-postgres_exporter-0.10.0-1.8.2 prometheus-postgres_exporter-0.10.0-150000.1.3.1 prometheus-postgres_exporter-0.10.1-3.6.4 python2-hwdata-2.3.5-12.9.1 python2-hwdata-2.3.5-15.12.2 python2-mgr-cfg-4.3.6-1.27.4 python2-mgr-cfg-actions-4.3.6-1.27.4 python2-mgr-cfg-client-4.3.6-1.27.4 python2-mgr-cfg-management-4.3.6-1.27.4 python2-mgr-osa-common-4.3.6-1.39.4 python2-mgr-osad-4.3.6-1.39.4 python2-mgr-push-4.3.4-1.21.4 python2-mgr-push-5.0.1-4.21.4 python2-mgr-virtualization-common-4.3.5-1.29.3 python2-mgr-virtualization-host-4.3.5-1.29.3 python2-rhnlib-4.3.4-21.43.3 python2-rhnlib-5.0.1-24.30.3 python2-spacewalk-check-4.3.9-52.71.3 python2-spacewalk-client-setup-4.3.9-52.71.3 python2-spacewalk-client-tools-4.3.9-52.71.3 python2-spacewalk-koan-4.3.5-24.33.3 python2-spacewalk-oscap-4.3.5-19.27.1 python2-suseRegisterInfo-4.3.3-25.27.3 python2-uyuni-common-libs-4.3.4-1.21.3 python2-uyuni-common-libs-5.0.1-3.33.3 python3-mgr-cfg-4.2.8-150000.1.24.1 python3-mgr-cfg-actions-4.2.8-150000.1.24.1 python3-mgr-cfg-client-4.2.8-150000.1.24.1 python3-mgr-cfg-management-4.2.8-150000.1.24.1 python3-mgr-osa-common-4.2.8-150000.1.36.1 python3-mgr-osad-4.2.8-150000.1.36.1 python3-mgr-push-4.2.5-150000.1.18.2 python3-mgr-virtualization-common-4.2.4-150000.1.26.1 python3-mgr-virtualization-host-4.2.4-150000.1.26.1 python3-rhnlib-4.2.6-150000.3.34.1 python3-spacewalk-check-4.2.18-150000.3.59.1 python3-spacewalk-client-setup-4.2.18-150000.3.59.1 python3-spacewalk-client-tools-4.2.18-150000.3.59.1 python3-spacewalk-koan-4.2.6-150000.3.27.1 python3-spacewalk-oscap-4.2.4-150000.3.18.1 python3-suseRegisterInfo-4.2.6-150000.3.21.1 spacecmd-4.2.16-150000.3.77.1 spacecmd-4.3.11-38.103.3 spacecmd-5.0.1-41.42.3 spacewalk-check-4.2.18-150000.3.59.1 spacewalk-check-4.3.9-52.71.3 spacewalk-client-setup-4.2.18-150000.3.59.1 spacewalk-client-setup-4.3.9-52.71.3 spacewalk-client-tools-4.2.18-150000.3.59.1 spacewalk-client-tools-4.3.9-52.71.3 spacewalk-koan-4.2.6-150000.3.27.1 spacewalk-koan-4.3.5-24.33.3 spacewalk-oscap-4.2.4-150000.3.18.1 spacewalk-oscap-4.3.5-19.27.1 spacewalk-remote-utils-4.3.3-24.24.3 supportutils-plugin-salt-1.2.0-6.16.1 supportutils-plugin-salt-1.2.2-9.9.2 supportutils-plugin-susemanager-client-4.3.2-6.24.1 supportutils-plugin-susemanager-client-5.0.1-9.15.2 suseRegisterInfo-4.2.6-150000.3.21.1 suseRegisterInfo-4.3.3-25.27.3 system-user-grafana-1.0.0-3.7.2 system-user-prometheus-1.0.0-3.7.2 grafana-8.3.5-150200.3.21.1 as a component of Container ses/7.1/ceph/grafana:8.3.10.2.2.285 grafana-8.3.5-150200.3.21.1 as a component of Container ses/7/ceph/grafana:8.3.5.3.778 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of HPE Helion OpenStack 8 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of Image server-image grafana-8.5.13-150100.3.12.1 as a component of SUSE Enterprise Storage 6 grafana-7.5.15-3.el8 as a component of SUSE Liberty Linux 8 grafana-7.5.15-3.el9 as a component of SUSE Liberty Linux 9 grafana-8.3.10-150200.3.26.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP4 grafana-8.3.5-150200.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 grafana-8.3.5-150200.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 grafana-8.3.5-150200.3.21.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP3-BCL golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP3-TERADATA golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server 12 SP5 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 golang-github-QubitProducts-exporter_exporter-0.4.0-1.6.1 as a component of SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager-0.23.0-1.12.3 as a component of SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE Manager Client Tools 12 grafana-8.3.5-1.30.3 as a component of SUSE Manager Client Tools 12 mgr-cfg-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 mgr-cfg-actions-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 mgr-cfg-client-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 mgr-cfg-management-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 mgr-custom-info-4.3.3-1.18.1 as a component of SUSE Manager Client Tools 12 mgr-daemon-4.3.4-1.32.3 as a component of SUSE Manager Client Tools 12 mgr-osad-4.3.6-1.39.4 as a component of SUSE Manager Client Tools 12 mgr-push-4.3.4-1.21.4 as a component of SUSE Manager Client Tools 12 mgr-virtualization-host-4.3.5-1.29.3 as a component of SUSE Manager Client Tools 12 prometheus-blackbox_exporter-0.19.0-1.8.2 as a component of SUSE Manager Client Tools 12 prometheus-postgres_exporter-0.10.0-1.8.2 as a component of SUSE Manager Client Tools 12 python2-hwdata-2.3.5-12.9.1 as a component of SUSE Manager Client Tools 12 python2-mgr-cfg-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 python2-mgr-cfg-actions-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 python2-mgr-cfg-client-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 python2-mgr-cfg-management-4.3.6-1.27.4 as a component of SUSE Manager Client Tools 12 python2-mgr-osa-common-4.3.6-1.39.4 as a component of SUSE Manager Client Tools 12 python2-mgr-osad-4.3.6-1.39.4 as a component of SUSE Manager Client Tools 12 python2-mgr-push-4.3.4-1.21.4 as a component of SUSE Manager Client Tools 12 python2-mgr-virtualization-common-4.3.5-1.29.3 as a component of SUSE Manager Client Tools 12 python2-mgr-virtualization-host-4.3.5-1.29.3 as a component of SUSE Manager Client Tools 12 python2-rhnlib-4.3.4-21.43.3 as a component of SUSE Manager Client Tools 12 python2-spacewalk-check-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 python2-spacewalk-client-setup-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 python2-spacewalk-client-tools-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 python2-spacewalk-koan-4.3.5-24.33.3 as a component of SUSE Manager Client Tools 12 python2-spacewalk-oscap-4.3.5-19.27.1 as a component of SUSE Manager Client Tools 12 python2-suseRegisterInfo-4.3.3-25.27.3 as a component of SUSE Manager Client Tools 12 python2-uyuni-common-libs-4.3.4-1.21.3 as a component of SUSE Manager Client Tools 12 spacecmd-4.3.11-38.103.3 as a component of SUSE Manager Client Tools 12 spacewalk-check-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 spacewalk-client-setup-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 spacewalk-client-tools-4.3.9-52.71.3 as a component of SUSE Manager Client Tools 12 spacewalk-koan-4.3.5-24.33.3 as a component of SUSE Manager Client Tools 12 spacewalk-oscap-4.3.5-19.27.1 as a component of SUSE Manager Client Tools 12 spacewalk-remote-utils-4.3.3-24.24.3 as a component of SUSE Manager Client Tools 12 supportutils-plugin-salt-1.2.0-6.16.1 as a component of SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client-4.3.2-6.24.1 as a component of SUSE Manager Client Tools 12 suseRegisterInfo-4.3.3-25.27.3 as a component of SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter-0.4.0-4.6.2 as a component of SUSE Manager Client Tools 12-BETA golang-github-boynux-squid_exporter-1.6-4.9.2 as a component of SUSE Manager Client Tools 12-BETA golang-github-lusitaniae-apache_exporter-1.0.0-4.12.4 as a component of SUSE Manager Client Tools 12-BETA golang-github-prometheus-alertmanager-0.26.0-4.12.4 as a component of SUSE Manager Client Tools 12-BETA golang-github-prometheus-node_exporter-1.5.0-4.15.4 as a component of SUSE Manager Client Tools 12-BETA golang-github-prometheus-prometheus-2.45.0-4.33.3 as a component of SUSE Manager Client Tools 12-BETA golang-github-prometheus-promu-0.14.0-4.12.2 as a component of SUSE Manager Client Tools 12-BETA grafana-9.5.8-4.21.2 as a component of SUSE Manager Client Tools 12-BETA kiwi-desc-saltboot-0.1.1687520761.cefb248-4.15.2 as a component of SUSE Manager Client Tools 12-BETA mgr-push-5.0.1-4.21.4 as a component of SUSE Manager Client Tools 12-BETA prometheus-blackbox_exporter-0.24.0-3.6.3 as a component of SUSE Manager Client Tools 12-BETA prometheus-postgres_exporter-0.10.1-3.6.4 as a component of SUSE Manager Client Tools 12-BETA python2-hwdata-2.3.5-15.12.2 as a component of SUSE Manager Client Tools 12-BETA python2-mgr-push-5.0.1-4.21.4 as a component of SUSE Manager Client Tools 12-BETA python2-rhnlib-5.0.1-24.30.3 as a component of SUSE Manager Client Tools 12-BETA python2-uyuni-common-libs-5.0.1-3.33.3 as a component of SUSE Manager Client Tools 12-BETA spacecmd-5.0.1-41.42.3 as a component of SUSE Manager Client Tools 12-BETA supportutils-plugin-salt-1.2.2-9.9.2 as a component of SUSE Manager Client Tools 12-BETA supportutils-plugin-susemanager-client-5.0.1-9.15.2 as a component of SUSE Manager Client Tools 12-BETA system-user-grafana-1.0.0-3.7.2 as a component of SUSE Manager Client Tools 12-BETA system-user-prometheus-1.0.0-3.7.2 as a component of SUSE Manager Client Tools 12-BETA grafana-8.3.5-150000.1.30.1 as a component of SUSE Manager Client Tools 15 mgr-cfg-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 mgr-cfg-actions-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 mgr-cfg-client-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 mgr-cfg-management-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 mgr-osad-4.2.8-150000.1.36.1 as a component of SUSE Manager Client Tools 15 mgr-push-4.2.5-150000.1.18.2 as a component of SUSE Manager Client Tools 15 mgr-virtualization-host-4.2.4-150000.1.26.1 as a component of SUSE Manager Client Tools 15 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of SUSE Manager Client Tools 15 python3-mgr-cfg-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 python3-mgr-cfg-actions-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 python3-mgr-cfg-client-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 python3-mgr-cfg-management-4.2.8-150000.1.24.1 as a component of SUSE Manager Client Tools 15 python3-mgr-osa-common-4.2.8-150000.1.36.1 as a component of SUSE Manager Client Tools 15 python3-mgr-osad-4.2.8-150000.1.36.1 as a component of SUSE Manager Client Tools 15 python3-mgr-push-4.2.5-150000.1.18.2 as a component of SUSE Manager Client Tools 15 python3-mgr-virtualization-common-4.2.4-150000.1.26.1 as a component of SUSE Manager Client Tools 15 python3-mgr-virtualization-host-4.2.4-150000.1.26.1 as a component of SUSE Manager Client Tools 15 python3-rhnlib-4.2.6-150000.3.34.1 as a component of SUSE Manager Client Tools 15 python3-spacewalk-check-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 python3-spacewalk-client-setup-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 python3-spacewalk-client-tools-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 python3-spacewalk-koan-4.2.6-150000.3.27.1 as a component of SUSE Manager Client Tools 15 python3-spacewalk-oscap-4.2.4-150000.3.18.1 as a component of SUSE Manager Client Tools 15 python3-suseRegisterInfo-4.2.6-150000.3.21.1 as a component of SUSE Manager Client Tools 15 spacecmd-4.2.16-150000.3.77.1 as a component of SUSE Manager Client Tools 15 spacewalk-check-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 spacewalk-client-setup-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 spacewalk-client-tools-4.2.18-150000.3.59.1 as a component of SUSE Manager Client Tools 15 spacewalk-koan-4.2.6-150000.3.27.1 as a component of SUSE Manager Client Tools 15 spacewalk-oscap-4.2.4-150000.3.18.1 as a component of SUSE Manager Client Tools 15 suseRegisterInfo-4.2.6-150000.3.21.1 as a component of SUSE Manager Client Tools 15 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of SUSE Manager Server Module 4.2 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE OpenStack Cloud 8 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE OpenStack Cloud 9 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE OpenStack Cloud Crowbar 8 golang-github-prometheus-node_exporter-1.3.0-1.15.3 as a component of SUSE OpenStack Cloud Crowbar 9 grafana-8.3.10-150200.3.26.1 as a component of openSUSE Leap 15.3 prometheus-postgres_exporter-0.10.0-150000.1.3.1 as a component of openSUSE Leap 15.3 python3-rhnlib-4.2.6-150000.3.34.1 as a component of openSUSE Leap 15.3 spacecmd-4.2.16-150000.3.77.1 as a component of openSUSE Leap 15.3 grafana-8.3.10-150200.3.26.1 as a component of openSUSE Leap 15.4 grafana-8.3.5-1.1 as a component of openSUSE Tumbleweed Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability. CVE-2022-21702 Container ses/7.1/ceph/grafana:8.3.10.2.2.285:grafana-8.3.5-150200.3.21.1 Container ses/7/ceph/grafana:8.3.5.3.778:grafana-8.3.5-150200.3.21.1 Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122:prometheus-postgres_exporter-0.10.0-150000.1.3.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40:prometheus-postgres_exporter-0.10.0-150000.1.3.1 HPE Helion OpenStack 8:golang-github-prometheus-node_exporter-1.3.0-1.15.3 Image server-image:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Enterprise Storage 6:grafana-8.5.13-150100.3.12.1 SUSE Liberty Linux 8:grafana-7.5.15-3.el8 SUSE Liberty Linux 9:grafana-7.5.15-3.el9 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:python3-mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:spacecmd-4.2.16-150000.3.77.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:uyuni-base-common-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:uyuni-base-proxy-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:uyuni-base-server-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP4:wire-0.5.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:python3-mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:spacecmd-4.2.16-150000.3.77.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:uyuni-base-common-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:uyuni-base-proxy-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:uyuni-base-server-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP5:wire-0.5.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:python3-mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:spacecmd-4.2.16-150000.3.77.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:uyuni-base-common-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:uyuni-base-proxy-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:uyuni-base-server-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP6:wire-0.5.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:python3-mgr-osa-dispatcher-4.2.8-150000.1.36.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:spacecmd-4.2.16-150000.3.77.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:uyuni-base-common-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:uyuni-base-proxy-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:uyuni-base-server-4.2.3-150000.1.6.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:wire-0.5.0-150000.1.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP4:grafana-8.3.10-150200.3.26.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-8.3.5-150200.3.21.1 SUSE Linux Enterprise Server 12 SP3-BCL:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP3-ESPOS:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP3-LTSS:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP3-TERADATA:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP4-ESPOS:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP4-LTSS:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server 12 SP5:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server for SAP Applications 12 SP3:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server for SAP Applications 12 SP4:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Linux Enterprise Server for SAP Applications 12 SP5:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Manager Client Tools 12:golang-github-QubitProducts-exporter_exporter-0.4.0-1.6.1 SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.23.0-1.12.3 SUSE Manager Client Tools 12:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE Manager Client Tools 12:grafana-8.3.5-1.30.3 SUSE Manager Client Tools 12:mgr-cfg-4.3.6-1.27.4 SUSE Manager Client Tools 12:mgr-cfg-actions-4.3.6-1.27.4 SUSE Manager Client Tools 12:mgr-cfg-client-4.3.6-1.27.4 SUSE Manager Client Tools 12:mgr-cfg-management-4.3.6-1.27.4 SUSE Manager Client Tools 12:mgr-custom-info-4.3.3-1.18.1 SUSE Manager Client Tools 12:mgr-daemon-4.3.4-1.32.3 SUSE Manager Client Tools 12:mgr-osad-4.3.6-1.39.4 SUSE Manager Client Tools 12:mgr-push-4.3.4-1.21.4 SUSE Manager Client Tools 12:mgr-virtualization-host-4.3.5-1.29.3 SUSE Manager Client Tools 12:prometheus-blackbox_exporter-0.19.0-1.8.2 SUSE Manager Client Tools 12:prometheus-postgres_exporter-0.10.0-1.8.2 SUSE Manager Client Tools 12:python2-hwdata-2.3.5-12.9.1 SUSE Manager Client Tools 12:python2-mgr-cfg-4.3.6-1.27.4 SUSE Manager Client Tools 12:python2-mgr-cfg-actions-4.3.6-1.27.4 SUSE Manager Client Tools 12:python2-mgr-cfg-client-4.3.6-1.27.4 SUSE Manager Client Tools 12:python2-mgr-cfg-management-4.3.6-1.27.4 SUSE Manager Client Tools 12:python2-mgr-osa-common-4.3.6-1.39.4 SUSE Manager Client Tools 12:python2-mgr-osad-4.3.6-1.39.4 SUSE Manager Client Tools 12:python2-mgr-push-4.3.4-1.21.4 SUSE Manager Client Tools 12:python2-mgr-virtualization-common-4.3.5-1.29.3 SUSE Manager Client Tools 12:python2-mgr-virtualization-host-4.3.5-1.29.3 SUSE Manager Client Tools 12:python2-rhnlib-4.3.4-21.43.3 SUSE Manager Client Tools 12:python2-spacewalk-check-4.3.9-52.71.3 SUSE Manager Client Tools 12:python2-spacewalk-client-setup-4.3.9-52.71.3 SUSE Manager Client Tools 12:python2-spacewalk-client-tools-4.3.9-52.71.3 SUSE Manager Client Tools 12:python2-spacewalk-koan-4.3.5-24.33.3 SUSE Manager Client Tools 12:python2-spacewalk-oscap-4.3.5-19.27.1 SUSE Manager Client Tools 12:python2-suseRegisterInfo-4.3.3-25.27.3 SUSE Manager Client Tools 12:python2-uyuni-common-libs-4.3.4-1.21.3 SUSE Manager Client Tools 12:spacecmd-4.3.11-38.103.3 SUSE Manager Client Tools 12:spacewalk-check-4.3.9-52.71.3 SUSE Manager Client Tools 12:spacewalk-client-setup-4.3.9-52.71.3 SUSE Manager Client Tools 12:spacewalk-client-tools-4.3.9-52.71.3 SUSE Manager Client Tools 12:spacewalk-koan-4.3.5-24.33.3 SUSE Manager Client Tools 12:spacewalk-oscap-4.3.5-19.27.1 SUSE Manager Client Tools 12:spacewalk-remote-utils-4.3.3-24.24.3 SUSE Manager Client Tools 12:supportutils-plugin-salt-1.2.0-6.16.1 SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-4.3.2-6.24.1 SUSE Manager Client Tools 12:suseRegisterInfo-4.3.3-25.27.3 SUSE Manager Client Tools 12-BETA:golang-github-QubitProducts-exporter_exporter-0.4.0-4.6.2 SUSE Manager Client Tools 12-BETA:golang-github-boynux-squid_exporter-1.6-4.9.2 SUSE Manager Client Tools 12-BETA:golang-github-lusitaniae-apache_exporter-1.0.0-4.12.4 SUSE Manager Client Tools 12-BETA:golang-github-prometheus-alertmanager-0.26.0-4.12.4 SUSE Manager Client Tools 12-BETA:golang-github-prometheus-node_exporter-1.5.0-4.15.4 SUSE Manager Client Tools 12-BETA:golang-github-prometheus-prometheus-2.45.0-4.33.3 SUSE Manager Client Tools 12-BETA:golang-github-prometheus-promu-0.14.0-4.12.2 SUSE Manager Client Tools 12-BETA:grafana-9.5.8-4.21.2 SUSE Manager Client Tools 12-BETA:kiwi-desc-saltboot-0.1.1687520761.cefb248-4.15.2 SUSE Manager Client Tools 12-BETA:mgr-push-5.0.1-4.21.4 SUSE Manager Client Tools 12-BETA:prometheus-blackbox_exporter-0.24.0-3.6.3 SUSE Manager Client Tools 12-BETA:prometheus-postgres_exporter-0.10.1-3.6.4 SUSE Manager Client Tools 12-BETA:python2-hwdata-2.3.5-15.12.2 SUSE Manager Client Tools 12-BETA:python2-mgr-push-5.0.1-4.21.4 SUSE Manager Client Tools 12-BETA:python2-rhnlib-5.0.1-24.30.3 SUSE Manager Client Tools 12-BETA:python2-uyuni-common-libs-5.0.1-3.33.3 SUSE Manager Client Tools 12-BETA:spacecmd-5.0.1-41.42.3 SUSE Manager Client Tools 12-BETA:supportutils-plugin-salt-1.2.2-9.9.2 SUSE Manager Client Tools 12-BETA:supportutils-plugin-susemanager-client-5.0.1-9.15.2 SUSE Manager Client Tools 12-BETA:system-user-grafana-1.0.0-3.7.2 SUSE Manager Client Tools 12-BETA:system-user-prometheus-1.0.0-3.7.2 SUSE Manager Client Tools 15:grafana-8.3.5-150000.1.30.1 SUSE Manager Client Tools 15:mgr-cfg-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:mgr-cfg-actions-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:mgr-cfg-client-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:mgr-cfg-management-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:mgr-osad-4.2.8-150000.1.36.1 SUSE Manager Client Tools 15:mgr-push-4.2.5-150000.1.18.2 SUSE Manager Client Tools 15:mgr-virtualization-host-4.2.4-150000.1.26.1 SUSE Manager Client Tools 15:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE Manager Client Tools 15:python3-mgr-cfg-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:python3-mgr-cfg-actions-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:python3-mgr-cfg-client-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:python3-mgr-cfg-management-4.2.8-150000.1.24.1 SUSE Manager Client Tools 15:python3-mgr-osa-common-4.2.8-150000.1.36.1 SUSE Manager Client Tools 15:python3-mgr-osad-4.2.8-150000.1.36.1 SUSE Manager Client Tools 15:python3-mgr-push-4.2.5-150000.1.18.2 SUSE Manager Client Tools 15:python3-mgr-virtualization-common-4.2.4-150000.1.26.1 SUSE Manager Client Tools 15:python3-mgr-virtualization-host-4.2.4-150000.1.26.1 SUSE Manager Client Tools 15:python3-rhnlib-4.2.6-150000.3.34.1 SUSE Manager Client Tools 15:python3-spacewalk-check-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:python3-spacewalk-koan-4.2.6-150000.3.27.1 SUSE Manager Client Tools 15:python3-spacewalk-oscap-4.2.4-150000.3.18.1 SUSE Manager Client Tools 15:python3-suseRegisterInfo-4.2.6-150000.3.21.1 SUSE Manager Client Tools 15:spacecmd-4.2.16-150000.3.77.1 SUSE Manager Client Tools 15:spacewalk-check-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:spacewalk-client-setup-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:spacewalk-client-tools-4.2.18-150000.3.59.1 SUSE Manager Client Tools 15:spacewalk-koan-4.2.6-150000.3.27.1 SUSE Manager Client Tools 15:spacewalk-oscap-4.2.4-150000.3.18.1 SUSE Manager Client Tools 15:suseRegisterInfo-4.2.6-150000.3.21.1 SUSE Manager Server Module 4.2:prometheus-postgres_exporter-0.10.0-150000.1.3.1 SUSE OpenStack Cloud 8:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE OpenStack Cloud 9:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE OpenStack Cloud Crowbar 8:golang-github-prometheus-node_exporter-1.3.0-1.15.3 SUSE OpenStack Cloud Crowbar 9:golang-github-prometheus-node_exporter-1.3.0-1.15.3 openSUSE Leap 15.3:grafana-8.3.10-150200.3.26.1 openSUSE Leap 15.3:prometheus-postgres_exporter-0.10.0-150000.1.3.1 openSUSE Leap 15.3:python3-rhnlib-4.2.6-150000.3.34.1 openSUSE Leap 15.3:spacecmd-4.2.16-150000.3.77.1 openSUSE Leap 15.4:grafana-8.3.10-150200.3.26.1 openSUSE Tumbleweed:grafana-8.3.5-1.1 moderate 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N