PT-2022-7306 · Grafana+5 · Grafana+5
Vtorosyan
·
Published
2022-11-08
·
Updated
2025-09-29
·
CVE-2022-39307
CVSS v4.0
7.3
High
| Vector | AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Grafana versions prior to 8.5.15
Grafana versions 9.0.0 through 9.2.3
Description
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the "/api/user/password/sent-reset-email" URL. When the
username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk.Recommendations
For Grafana versions prior to 8.5.15, update to version 8.5.15 or later.
For Grafana versions 9.0.0 through 9.2.3, update to version 9.2.4 or later.
As a temporary workaround, consider restricting access to the
/api/user/password/sent-reset-email API endpoint until a patch is available.Exploit
Fix
Generation of Error Message Containing Sensitive Information
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Grafana
Red Hat
Red Os
Suse