CVE-2022-39307

🗓️ 09 Nov 2022 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 936 Views🌐 WEB

Grafana open-source platform forget password feature information leak CVE-2022-3930

Reporter	Title	Published	Views	Family All 105
FreeBSD	Grafana -- Username enumeration	24 Oct 202200:00	–	freebsd
FreeBSD	Grafana -- Privilege escalation	24 Oct 202200:00	–	freebsd
FreeBSD	Grafana -- Privilege escalation	8 Nov 202200:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana	26 Mar 202502:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to exposure of sensitive information to an unauthorized actor in Grafana (CVE-2022-39307)	1 Nov 202319:40	–	ibm
AlpineLinux	CVE-2022-39307	9 Nov 202223:15	–	alpinelinux
AlmaLinux	Moderate: grafana security and enhancement update	7 Nov 202300:00	–	almalinux
ALT Linux	Security fix for the ALT Linux 10 package grafana version 8.5.20-alt1	31 Jan 202300:00	–	altlinux
BDU FSTEC	The vulnerability of the Grafana monitoring and observation platform, related to the disclosure of confidential information to unauthorized entities, allows attackers to gain access to confidential data.	5 Apr 202400:00	–	bdu_fstec
Chainguard	CVE-2022-39307 vulnerabilities	9 Nov 202223:15	–	cgr

NVD

Vulners

Node

grafana grafanaRange<8.5.15

grafana grafanaRange9.0.0–9.2.4

[
  {
    "vendor": "grafana",
    "product": "grafana",
    "versions": [
      {
        "version": ">= v9.0.0-beta1, < 9.2.4",
        "status": "affected"
      },
      {
        "version": "< 8.5.15",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
security	www.security.netapp.com/advisory/ntap-20221215-0004/

Parameter	Position	Path	Description	CWE
username	request body	/api/user/password/sent-reset-email	Info disclosure for non-existent user on password reset endpoint (verifies user existence to unauthenticated users).	CWE-200, CWE-209
email	request body	/api/user/password/sent-reset-email	Info disclosure for non-existent user on password reset endpoint (verifies user existence to unauthenticated users).	CWE-200, CWE-209