{"containers": {"cna": {"affected": [{"product": "grafana", "vendor": "grafana", "versions": [{"status": "affected", "version": ">= 5.3, < 8.3.10"}, {"status": "affected", "version": ">= 8.4.0, < 8.4.10"}, {"status": "affected", "version": ">= 8.5.0, < 8.5.9"}, {"status": "affected", "version": ">= 9.0.0, < 9.0.3"}]}], "descriptions": [{"lang": "en", "value": "Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-01T13:06:35", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"}, {"tags": ["x_refsource_MISC"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/"}, {"tags": ["x_refsource_MISC"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"}], "source": {"advisory": "GHSA-mx47-6497-3fv2", "discovery": "UNKNOWN"}, "title": "Grafana account takeover via OAuth vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-31107", "STATE": "PUBLIC", "TITLE": "Grafana account takeover via OAuth vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "grafana", "version": {"version_data": [{"version_value": ">= 5.3, < 8.3.10"}, {"version_value": ">= 8.4.0, < 8.4.10"}, {"version_value": ">= 8.5.0, < 8.5.9"}, {"version_value": ">= 9.0.0, < 9.0.3"}]}}]}, "vendor_name": "grafana"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-863: Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/", "refsource": "MISC", "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"}, {"name": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2", "refsource": "CONFIRM", "url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"}, {"name": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/", "refsource": "MISC", "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/"}, {"name": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/", "refsource": "MISC", "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/"}, {"name": "https://security.netapp.com/advisory/ntap-20220901-0010/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"}]}, "source": {"advisory": "GHSA-mx47-6497-3fv2", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:11:38.479Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-31107", "datePublished": "2022-07-15T12:30:14", "dateReserved": "2022-05-18T00:00:00", "dateUpdated": "2024-08-03T07:11:38.479Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "84AA9DAD-BDBD-402E-B680-250A7295B57E", "versionEndExcluding": "8.3.10", "versionStartIncluding": "5.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5136FB0-D7F8-4BDD-9C70-CB2648065A1F", "versionEndExcluding": "8.4.10", "versionStartIncluding": "8.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C2FAADE-D9EA-431C-ACFA-9F846F14B5A2", "versionEndExcluding": "8.5.9", "versionStartIncluding": "8.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "matchCriteriaId": "A29E8B3E-D3A9-49A4-ABCD-4E87F8B527DD", "versionEndExcluding": "9.0.3", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*", "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address."}, {"lang": "es", "value": "Grafana es una plataforma de c\u00f3digo abierto para la monitorizaci\u00f3n y la observaci\u00f3n. En versiones 5.3 hasta 9.0.3, 8.5.9, 8.4.10 y 8.3.10, es posible que un usuario malicioso que tenga autorizaci\u00f3n para iniciar sesi\u00f3n en una instancia de Grafana por medio de un IdP de OAuth configurado que proporcione un nombre de inicio de sesi\u00f3n, tome la cuenta de otro usuario en esa instancia de Grafana. Esto puede ocurrir cuando el usuario malicioso est\u00e1 autorizado a iniciar sesi\u00f3n en Grafana por medio de OAuth, el id de usuario externo del usuario malicioso no est\u00e1 ya asociado a una cuenta en Grafana, la direcci\u00f3n de correo electr\u00f3nico del usuario malicioso no est\u00e1 ya asociada a una cuenta en Grafana, y el usuario malicioso conoce el nombre de usuario de Grafana del usuario objetivo. Si son cumplidas estas condiciones, el usuario malicioso puede establecer su nombre de usuario en el proveedor OAuth al del usuario objetivo, y luego pasar por el flujo OAuth para iniciar sesi\u00f3n en Grafana. Debido a la forma en que las cuentas de usuario externas e internas est\u00e1n vinculadas durante el inicio de sesi\u00f3n, si las condiciones anteriores son cumplidas, el usuario malicioso podr\u00e1 iniciar sesi\u00f3n en la cuenta de Grafana del usuario objetivo. Las versiones 9.0.3, 8.5.9, 8.4.10 y 8.3.10 contienen un parche para este problema. Como mitigaci\u00f3n, los usuarios afectados pueden deshabilitar el inicio de sesi\u00f3n de OAuth en su instancia de Grafana, o asegurarse de que todos los usuarios autorizados a iniciar sesi\u00f3n por medio de OAuth presentan una cuenta de usuario correspondiente en Grafana vinculada a su direcci\u00f3n de correo electr\u00f3nico"}], "id": "CVE-2022-31107", "lastModified": "2024-11-21T07:03:54.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.5, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-07-15T13:15:08.397", "references": [{"source": "[email protected]", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/"}, {"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "[email protected]", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges HTTPVoid team as the original reporter.", "affected_release": [{"advisory": "RHSA-2023:3642", "cpe": "cpe:/a:redhat:ceph_storage:6.1::el9", "package": "rhceph/rhceph-6-dashboard-rhel9:6-75", "product_name": "Red Hat Ceph Storage 6.1", "release_date": "2023-06-15T00:00:00Z"}, {"advisory": "RHSA-2022:5717", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "grafana-0:7.5.11-3.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-07-26T00:00:00Z"}, {"advisory": "RHSA-2022:5720", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "grafana-0:6.2.2-9.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-07-26T00:00:00Z"}, {"advisory": "RHSA-2022:5719", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "grafana-0:6.3.6-5.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-07-26T00:00:00Z"}, {"advisory": "RHSA-2022:5718", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "grafana-0:7.3.6-5.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-07-26T00:00:00Z"}, {"advisory": "RHSA-2022:5716", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "grafana-0:7.5.11-5.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-07-26T00:00:00Z"}], "bugzilla": {"description": "grafana: OAuth account takeover", "id": "2104367", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2104367"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "verified"}, "cwe": "CWE-287", "details": ["Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.", "A flaw was found in Grafana. This flaw allows a malicious user with the authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under certain conditions."], "mitigation": {"lang": "en:us", "value": "As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address."}, "name": "CVE-2022-31107", "package_state": [{"cpe": "cpe:/a:redhat:service_mesh:2.0", "fix_state": "Affected", "package_name": "servicemesh-grafana", "product_name": "OpenShift Service Mesh 2.0"}, {"cpe": "cpe:/a:redhat:service_mesh:2.1", "fix_state": "Affected", "package_name": "servicemesh-grafana", "product_name": "OpenShift Service Mesh 2.1"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-grafana-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:quarkus:2", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:ceph_storage:3", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Ceph Storage 3"}, {"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Affected", "package_name": "rhceph/rhceph-4-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Affected", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-grafana", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Storage 3"}], "public_date": "2022-07-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-31107\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-31107\nhttps://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"], "threat_severity": "Important", "upstream_fix": "Grafana 9.0.3, Grafana 8.5.9, Grafana 8.4.10, Grafana 8.3.10"}