CVE-2022-35957

Katalog CVE

CVSS 6.6 · Medium EPSS 1,6%

Kerentanan Authentication Bypass by Spoofing pada grafana, fedoraproject fedora. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

Rincian

Terbit di NVD

20 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q advisory vendor
• https://security.netapp.com/advisory/ntap-20221215-0001/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZ...