CVE-2022-39307
published 2022-11-09CVE-2022-39307: Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.70%
48.3th percentile
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 0 < 8.5.15 | 8.5.15 |
| github.com | grafana_grafana | >= 9.0.0 < 9.2.4 | 9.2.4 |
| grafana | grafana | < 8.5.15 | 8.5.15 |
| grafana | grafana | — | — |
| grafana | grafana | >= 9.0.0 < 9.2.4 | 9.2.4 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Grafana User enumeration via forget password in github.com/grafana/grafana
osv·2024-06-05
CVE-2022-39307 Grafana User enumeration via forget password in github.com/grafana/grafana
Grafana User enumeration via forget password in github.com/grafana/grafana
Grafana User enumeration via forget password in github.com/grafana/grafana.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/grafana/grafana before v8.5.15, from v9.0.0 before v9.2.4.
GHSA
Grafana User enumeration via forget password
ghsa·2024-05-14·CVSS 5.3
CVE-2022-39307 [MEDIUM] CWE-200 Grafana User enumeration via forget password
Grafana User enumeration via forget password
Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307.
We are also releasing security patches for Grafana 8.5.15 to fix these issues.
Release 9.2.4, latest patch, also containing security fix:
- [Download Grafana 9.2.4](https://grafana.com/grafana/download/9.2.4)
Release 8.5.15, only containing security fix:
- [Download Grafana 8.5.15](https://grafana.com/grafana/download/8.5.15)
Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the
OSV
Grafana User enumeration via forget password
osv·2024-05-14·CVSS 5.3
CVE-2022-39307 [MEDIUM] Grafana User enumeration via forget password
Grafana User enumeration via forget password
Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307.
We are also releasing security patches for Grafana 8.5.15 to fix these issues.
Release 9.2.4, latest patch, also containing security fix:
- [Download Grafana 9.2.4](https://grafana.com/grafana/download/9.2.4)
Release 8.5.15, only containing security fix:
- [Download Grafana 8.5.15](https://grafana.com/grafana/download/8.5.15)
Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the
OSV
CVE-2022-39307: Grafana is an open-source platform for monitoring and observability
osv·2022-11-09·CVSS 5.3
CVE-2022-39307 [MEDIUM] CVE-2022-39307: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
Red Hat
grafana: User enumeration via forget password
vendor_redhat·2022-11-08·CVSS 6.7
CVE-2022-39307 [MEDIUM] CWE-209 grafana: User enumeration via forget password
grafana: User enumeration via forget password
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
An information leak was discovered in Grafana. Remote unauthenticated users could exploit the forget password feature to discover which user accounts exist.
Package: openshift-logging/logging-loki-rhel8 (Logging Subsystem for Red Hat OpenShift) - Not affected
Package: openshift-logging/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-09
Published