CVE-2022-35957
Medium
Description
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
SeverityMedium
CVSS6.6
Exploit probability—
Product
Grafana
PublishedSep 20, 2022
First seenSep 20, 2022
Weakness typeCWE-290CWE-290
How to fix
Update
- grafana grafana8.5.13, 9.0.9, 9.1.6 or later
- github.com/grafana/grafana9.1.6, 9.0.9, 8.5.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana grafana | v < 8.5.13, 9.0.0 ≤ v < 9.0.9, 9.1.0 ≤ v < 9.1.6 | 8.5.13, 9.0.9, 9.1.6 |
| fedoraproject fedora | 37 | — |
| github.com/grafana/grafanaGo | 9.1.0 ≤ v < 9.1.6, 9.0.0 ≤ v < 9.0.9, v < 8.5.13, No range specified | 9.1.6, 9.0.9, 8.5.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.