CVE-2022-36062
published 2022-09-22CVE-2022-36062: Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation…
PriorityP415low3.8CVSS 3.1
AVNACLPRHUINSUCLILAN
EPSS
0.60%
44.0th percentile
Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 8.5.0 < 8.5.13 | 8.5.13 |
| github.com | grafana_grafana | >= 9.0.0 < 9.0.9 | 9.0.9 |
| github.com | grafana_grafana | >= 9.1.0 < 9.1.6 | 9.1.6 |
| grafana | grafana | < 8.5.13 | 8.5.13 |
| grafana | grafana | — | — |
| grafana | grafana | — | — |
| grafana | grafana | >= 9.0.0 < 9.0.9 | 9.0.9 |
| grafana | grafana | >= 9.1.0 < 9.1.6 | 9.1.6 |
CVSS provenance
nvdv3.13.8LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
ghsa3.8LOW
osv3.8LOW
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana folders admin only permission privilege escalation in github.com/grafana/grafana
osv·2024-06-05
CVE-2022-36062 Grafana folders admin only permission privilege escalation in github.com/grafana/grafana
Grafana folders admin only permission privilege escalation in github.com/grafana/grafana
Grafana folders admin only permission privilege escalation in github.com/grafana/grafana.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana from v8.5.0 before v8.5.13, from v9.0.0 before v9.0.9, from v9.1.0 before v9.1.6.
GHSA
Grafana folders admin only permission privilege escalation
ghsa·2024-05-14·CVSS 3.8
CVE-2022-36062 [LOW] CWE-281 Grafana folders admin only permission privilege escalation
Grafana folders admin only permission privilege escalation
Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-36062 that affects Grafana instances which are using Grafana role-based access control (RBAC).
Release 9.1.6, latest patch, also containing security fix:
- [Download Grafana 9.1.6](https://grafana.com/grafana/download/9.1.6)
- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-1-6/)
Release 9.0.9, only containing security fix:
- [Download Grafana 9.0.9](https://grafana.com/grafana/download/9.0.9)
- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-9/)
Release 8.5.13, only containing security fix:
- [Download Grafana 8.5.13](http
OSV
Grafana folders admin only permission privilege escalation
osv·2024-05-14·CVSS 3.8
CVE-2022-36062 [LOW] Grafana folders admin only permission privilege escalation
Grafana folders admin only permission privilege escalation
Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-36062 that affects Grafana instances which are using Grafana role-based access control (RBAC).
Release 9.1.6, latest patch, also containing security fix:
- [Download Grafana 9.1.6](https://grafana.com/grafana/download/9.1.6)
- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-1-6/)
Release 9.0.9, only containing security fix:
- [Download Grafana 9.0.9](https://grafana.com/grafana/download/9.0.9)
- [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-9/)
Release 8.5.13, only containing security fix:
- [Download Grafana 8.5.13](http
OSV
CVE-2022-36062: Grafana is an open-source platform for monitoring and observability
osv·2022-09-22·CVSS 3.8
CVE-2022-36062 [LOW] CVE-2022-36062: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permi
Red Hat
grafana: Grafana RBAC folders/dashboards privilege escalation
vendor_redhat·2022-09-20·CVSS 7.6
CVE-2022-36062 [HIGH] grafana: Grafana RBAC folders/dashboards privilege escalation
grafana: Grafana RBAC folders/dashboards privilege escalation
Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impac
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-22
Published