CVE-2022-35957

Name

CVE-2022-35957

Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
CONFIRM	https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
FEDORA	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
Third Party Advisory	https://security.netapp.com/advisory/ntap-20221215-0001/
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:grafana:grafana::::::::`	grafana	>= 9.1.0	< 9.1.6
`cpe:2.3:a:grafana:grafana::::::::`	grafana	>= 9.0.0	< 9.0.9
`cpe:2.3:a:grafana:grafana::::::::`	grafana	>= None	< 8.5.13

References

Match rules

Vulnerable and fixed packages