by Kastro
Paper/Archive/CVE-2022-39328

CVE-2022-39328

grafana grafana — Grafana vulnerable to race condition allowing privilege escalation

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.2.652 × 2013.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.

Affected

ProductAffectedFixed inSource
grafana>= 9.2.0, < 9.2.4–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxchrefsecurity.netapp.com/advisory/ntap-20221215-0003