Most recent entries from all

ALSA-2022:5716 — Important: grafana security update

Affected: AlmaLinux:9: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: OAuth account takeover (CVE-2022-31107) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-02573

BIT-grafana-2022-31107 — Grafana account takeover via OAuth vulnerability

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

certfr-2022-avi-649 — De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contourne…

certfr-2022-avi-649

EUVD-2026-266779

fkie_cve-2022-31107

GHSA-mx47-6497-3fv2 — Grafana account takeover via OAuth vulnerability

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.

Release v.9.0.3, containing this security fix and other patches:

- [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3) - [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/)

Release v.8.5.9, containing this security fix and other fixes:

- [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9) - [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/)

Release v.8.4.10, containing this security fix and other fixes:

- [Download Grafana 8.4.10](https://grafana.com/grafana/download/8.4.10) - [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/)

Release v.8.3.10, containing this security fix and other fixes:

- [Download Grafana 8.3.10](https://grafana.com/grafana/download/8.3.10)

## Grafana account takeover via OAuth vulnerability ([CVE-2022-31107](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31107))

### Summary On June 27 the HTTPVoid team contacted Grafana Labs to disclose a Grafana account takeover via an OAuth vulnerability.

We believe that this vulnerability is rated at CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

### Impact It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP…

gsd-2022-31107

OESA-2022-1870 — grafana security update

Affected: openEuler:20.03-LTS-SP1: grafana, openEuler:20.03-LTS-SP3: grafana, openEuler:22.03-LTS: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.…

openSUSE-SU-2024:12260-1 — grafana-8.3.10-1.1 on GA media

grafana-8.3.10-1.1 on GA media

RHSA-2022:5718 — Red Hat Security Advisory: grafana security update

grafana: OAuth account takeover

SUSE-SU-2022:3676-1 — Security update for grafana

Security update for grafana

UBUNTU-CVE-2022-31107

Affected: Ubuntu:16.04:LTS: grafana

WID-SEC-W-2022-0696 — Grafana: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und Sicherheitsmaßnahmen zu umgehen.