Race condition in Grafana - CVE-2022-39328

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU69486

Race condition in Grafana - CVE-2022-39328

Published: November 22, 2022


Vulnerability identifier: #VU69486
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-39328
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a race condition in the Grafana codebase. A remote attacker can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.


Affected software

Grafana
IBM Watson Machine Learning Accelerator

How to mitigate CVE-2022-39328

Install updates from vendor's website.

Grafana - update to 9.2.4
IBM Watson Machine Learning Accelerator - update to 3.0.0

External References

Related Security Bulletins