PT-2022-7314 · Grafana+1 · Grafana+1

Published 2022-11-08 · Updated 2024-06-05 · CVE-2022-39328

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grafana versions 9.2.0 through 9.2.3

Description Grafana is an open-source platform for monitoring and observability. The issue is related to a race condition in the authentication middlewares logic, which may allow an unauthenticated user to query an administration endpoint under heavy load. This could potentially allow a remote attacker to elevate their privileges. There are no known workarounds for this issue.

Recommendations For versions 9.2.0 through 9.2.3, update to version 9.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to administration endpoints to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2024-02627

BIT-GRAFANA-2022-39328

CVE-2022-39328

GHSA-VQC4-MPJ8-JXCH

GO-2024-2856

RHSA-2023:6420

Affected Products

Grafana

Red Os

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39328.json · Exploit
• https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02627 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39328 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqc4-mpj8-jxch · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39328 · Security Note
• https://osv.dev/vulnerability/BIT-grafana-2022-39328 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39328 · Security Note
• https://osv.dev/vulnerability/GO-2024-2856 · Vendor Advisory
• https://github.com/grafana/grafana · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-grafana-04-04-24 · Note
• https://t.me/pentestingnews/29990 · Telegram Post
• https://redos.red-soft.ru/support/secure · Note