PT-2022-19149 · Grafana · Grafana Enterprise Logs+1

Published 2022-05-20 · Updated 2024-03-06 · CVE-2022-28660

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grafana Enterprise Logs versions 1.1.x through 1.3.x

Description The querier component does not require authentication when X-Scope-OrgID is used, affecting -auth.type=enterprise in microservices mode.

Recommendations For versions 1.1.x through 1.3.x, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the querier component until a patch is available. Avoid using the X-Scope-OrgID header in the affected microservices mode until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-GRAFANA-2022-28660

CVE-2022-28660

Affected Products

Grafana

Grafana Enterprise Logs

References · 9

• https://grafana.com/docs/enterprise-logs/latest/gel-releases/#v121----may-3-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28660 · Security Note
• https://osv.dev/vulnerability/BIT-grafana-2022-28660 · Vendor Advisory
• https://t.me/cibsecurity/43060 · Telegram Post
• https://t.me/cvenotify/30508 · Telegram Post
• https://t.me/cvenotify/32745 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220707-0004 · Note
• https://t.me/cvenotify/31009 · Telegram Post