CVE-2022-39307mediumCWE-200

CVE-2022-39307: fallo de gravedad media en grafana

Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Grafana+ Monitorear github.com/grafana/grafana

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.7epss 0.9%
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Productos afectados
grafana · grafana
CVEs relacionadas — grafana

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 85.4%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 70.1%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 56.6%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.9%