Vulnerability · Published Sep 20, 2022 · Assigned by GitHub_M
CVE-2022-35957Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Medium 6.6
In plain English
A medium-severity authentication bypass by spoofing in grafana from grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | grafana | 9.0.9-2.el9 | ALSA-2023:2167 |
| Go | github.com/grafana/grafana | 9.1.6 | GHSA-ff5c-938w-8c9q |
| Go | github.com/grafana/grafana | 9.0.9 | GHSA-ff5c-938w-8c9q |
| Go | github.com/grafana/grafana | 8.5.13 | GHSA-ff5c-938w-8c9q |
| Go | github.com/grafana/grafana | no fix listed | GO-2024-2847 |
Affected products (as reported)
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H