PT-2022-7105 · Grafana · Grafana Enterprise Metrics

Published 2022-12-20 · Updated 2022-12-29 · CVE-2022-44643

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Grafana Enterprise Metrics versions prior to 1.7.1 Grafana Enterprise Metrics versions prior to 2.3.1

Description The issue is related to the label-based access control in Grafana Enterprise Metrics, allowing an attacker to have more access than intended. If an access policy with label selector restrictions is granted access to all tenants, the label selector restrictions will not be applied. This can impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider reviewing and restricting access policies to ensure that label selector restrictions are properly applied.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

BDU:2023-07588

CVE-2022-44643

Affected Products

Grafana Enterprise Metrics

References · 6

• https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v171----november-14th-2022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-44643 · Security Note
• https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v231----november-14th-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44643 · Vendor Advisory
• https://t.me/cibsecurity/54976 · Telegram Post