CVE-2022-39229: falha de média gravidade em grafana
Grafana users with email as a username can block other users from signing in
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 1.1%
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
grafana · grafanaCVEs relacionadas — grafana
No mesmo produto, das mais perigosas para as menos.
CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 85.4%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 70.1%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 56.6%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.9%