CVE-2022-31107
published 2022-07-15CVE-2022-31107: Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious…
PriorityP346high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
2.04%
78.7th percentile
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 5.3.0-beta1 < 8.3.10 | 8.3.10 |
| github.com | grafana_grafana | >= 8.4.0 < 8.4.10 | 8.4.10 |
| github.com | grafana_grafana | >= 8.5.0 < 8.5.9 | 8.5.9 |
| github.com | grafana_grafana | >= 9.0.0 < 9.0.3 | 9.0.3 |
| grafana | grafana | — | — |
| grafana | grafana | — | — |
| grafana | grafana | — | — |
| grafana | grafana | — | — |
| grafana | grafana | >= 5.3.0 < 8.3.10 | 8.3.10 |
| grafana | grafana | >= 8.4.0 < 8.4.10 | 8.4.10 |
| grafana | grafana | >= 8.5.0 < 8.5.9 | 8.5.9 |
| grafana | grafana | >= 9.0.0 < 9.0.3 | 9.0.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
osv·2024-06-05
CVE-2022-31107 Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana from v5.3.0 before v8.3.10, from v8.4.0 before v8.4.10, from v8.5.0 before v8.5.9, from v9.0.0 before v9.0.3.
OSV
Grafana account takeover via OAuth vulnerability
osv·2024-05-14·CVSS 7.5
CVE-2022-31107 [HIGH] Grafana account takeover via OAuth vulnerability
Grafana account takeover via OAuth vulnerability
Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.
Release v.9.0.3, containing this security fix and other patches:
- [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/)
Release v.8.5.9, containing this security fix and other fixes:
- [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/)
Release v.8.4.10, containing this security fix and other fixes:
- [Download Grafana 8.4.10](https://grafana.com/grafana/d
GHSA
Grafana account takeover via OAuth vulnerability
ghsa·2024-05-14·CVSS 7.5
CVE-2022-31107 [HIGH] CWE-863 Grafana account takeover via OAuth vulnerability
Grafana account takeover via OAuth vulnerability
Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.
Release v.9.0.3, containing this security fix and other patches:
- [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/)
Release v.8.5.9, containing this security fix and other fixes:
- [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/)
Release v.8.4.10, containing this security fix and other fixes:
- [Download Grafana 8.4.10](https://grafana.com/grafana/d
OSV
CVE-2022-31107: Grafana is an open-source platform for monitoring and observability
osv·2022-07-15·CVSS 7.5
CVE-2022-31107 [HIGH] CVE-2022-31107: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go
Red Hat
grafana: OAuth account takeover
vendor_redhat·2022-07-14·CVSS 7.1
CVE-2022-31107 [HIGH] CWE-287 grafana: OAuth account takeover
grafana: OAuth account takeover
Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/https://security.netapp.com/advisory/ntap-20220901-0010/https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/https://security.netapp.com/advisory/ntap-20220901-0010/
2022-07-15
Published