Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-78211
HistoryNov 10, 2022 - 12:00 a.m.

Grafana Competition Conditions Vulnerability

2022-11-1000:00:00
China National Vulnerability Database
www.cnvd.org.cn
7

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Grafana is a Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a contention condition vulnerability that stems from the inclusion of a contention condition in the authentication middleware logic, which can be exploited by an unauthenticated attacker to query management endpoints under heavy load.

CPENameOperatorVersion
grafana grafana >=9.2.0,lt9.2.4

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H