Vulnerability identifier: #VU72132

Vulnerability risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-39229

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Grafana
Web applications / Other software

Vendor: Grafana Labs

Description

The vulnerability allows a remote attacker to deny access to the application.

The vulnerability exists due to a logic error in the authentication process, where application allows usage of the same email address by different accounts. A remote user can set an existing email address that belongs to another user as their username and prevent that user from accessing the application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Grafana: 9.0.0 - 9.0.9, 8.5.0 - 8.5.13, 8.4.0 - 8.4.11, 8.3.0 - 8.3.11, 8.2.0 - 8.2.7, 8.1.0 - 8.1.8, 8.0.0 - 8.0.7

---

External links
http://github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35
http://github.com/grafana/grafana/releases/tag/v9.1.8
http://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.