CVE-2022-39307 Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password

2022-11-0900:00:00

CWE-200

GitHub_M

www.cve.org

grafana

sensitive information

user enumeration

CVSS3

6.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

35.5%

JSON

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.

CNA Affected

[
  {
    "vendor": "grafana",
    "product": "grafana",
    "versions": [
      {
        "version": ">= v9.0.0-beta1, < 9.2.4",
        "status": "affected"
      },
      {
        "version": "< 8.5.15",
        "status": "affected"
      }
    ]
  }
]