PT-2022-7312 · Grafana+5 · Grafana+5

Published 2022-09-20 · Updated 2025-09-29 · CVE-2022-35957

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 9.1.6 and 8.5.13

Description Grafana is an open-source platform for monitoring and observability. The issue is related to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the Grafana instance. This can be exploited by a remote attacker to gain unauthorized access to information and disrupt its integrity and availability.

Recommendations For versions prior to 9.1.6 and 8.5.13, upgrade to a newer version as soon as possible. As a temporary workaround, consider deactivating auth proxy following the instructions at the official Grafana documentation.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

ALSA-2023:2167

ALSA-2025_16880

ALT-PU-2022-3295

ALT-PU-2023-1161

ALT-PU-2023-4133

ALT-PU-2023-4346

ALT-PU-2023-4567

BDU:2024-02622

BIT-GRAFANA-2022-35957

CVE-2022-35957

ECHO-97AF-703E-9910

GHSA-FF5C-938W-8C9Q

GO-2024-2847

OESA-2025-1186

OESA-2025-1187

OESA-2025-1188

OESA-2025-1189

OPENSUSE-SU-2022_4428-1

OPENSUSE-SU-2022_4437-1

OPENSUSE-SU-2024:12366-1

RHSA-2023:2167

RHSA-2023_2167

SUSE-SU-2022:3676-1

SUSE-SU-2022:4428-1

SUSE-SU-2022:4437-1

SUSE-SU-2022:4439-1

SUSE-SU-2023:2575-1

SUSE-SU-2023:2578-1

SUSE-SU-2023:2579-1

SUSE-SU-2024:0191-1

SUSE-SU-2024:0196-1

Affected Products

Alt Linux

Almalinux

Grafana

Red Hat

Red Os

Suse

References · 211

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35957.json · Exploit
• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4428-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31123 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0196-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2167.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35957 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31130 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36062 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:4437-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35957 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2847 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1188 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1187 · Vendor Advisory