Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-35957

Good to know:

icon

Date: September 19, 2022

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

Language: Go

Severity Score

Related Resources (9)

https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
https://security.netapp.com/advisory/ntap-20221215-0001
https://github.com/grafana/grafana
https://security.netapp.com/advisory/ntap-20221215-0001/
https://nvd.nist.gov/vuln/detail/CVE-2022-35957
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYU5C2RITLHVZSTCWNGQWA6KSPYNXM2H
https://access.redhat.com/security/cve/CVE-2022-35957
https://www.mend.io/vulnerability-database/CVE-2022-35957

Severity Score

Weakness Type (CWE)

Authentication Bypass by Spoofing

CWE-290

Top Fix

icon

Upgrade Version

Upgrade to version v8.5.13,v9.0.9,v9.1.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us