Lucene search
Veracode Vulnerability DatabaseVERACODE:37584HistoryOct 17, 2022 - 8:35 a.m.
Authentication Bypass
2022-10-1708:35:54
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
authentication bypass
grafana
getuserbylogin
user.go
unauthorized access
vulnerability
0.001 Low
EPSS
Percentile
48.5%
grafana is vulnerable to Authentication Bypass. The vulnerability exists due to the GetUserByLogin function in user.go conflict in the login field; An attacker can register into the system from another user’s email address as a username blocking a user’s login attempt.
References
github.com/grafana/grafana/commit/1d58ef43fbd5fd0cea0e67229f7daeb698f0a64b
github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35
github.com/grafana/grafana/commit/85f581105a677d9c243d7e337b8b4a4e28cabc1c
github.com/grafana/grafana/commit/f5da38804163a17b893dc4343f8e5cc9d4f92a4d
github.com/grafana/grafana/pull/511
github.com/grafana/grafana/releases/tag/v9.1.8
github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r
Related
alpinelinux
alpinelinux
CVE-2022-39229
2022-10-13 23:15:00
osv
osv
CVE-2022-39229
2022-10-13 23:15:10
Grafana when using email as a username can block other users from signing in
2024-05-14 22:29:38
BIT-grafana-2022-39229
2024-03-06 10:55:10
ibm
ibm
github
github
Grafana when using email as a username can block other users from signing in
2024-05-14 22:29:38
cnvd
cnvd
Grafana Denial of Service Vulnerability
2022-10-14 00:00:00
cvelist
cvelist
redhatcve
redhatcve
CVE-2022-39229
2022-10-14 05:59:29
nvd
nvd
CVE-2022-39229
2022-10-13 23:15:10
ubuntucve
ubuntucve
CVE-2022-39229
2022-10-13 00:00:00
nessus
nessus
FreeBSD : Grafana -- Improper authentication (909a80ba-6294-11ed-9ca2-6c3be5272acd)
2022-11-13 00:00:00
CentOS 9 : grafana-9.0.9-2.el9
2024-02-29 00:00:00
Oracle Linux 8 : grafana (ELSA-2023-2784)
2023-05-24 00:00:00
prion
prion
Design/Logic Flaw
2022-10-13 23:15:00
cve
cve
CVE-2022-39229
2022-10-13 23:15:10
openvas
openvas
Grafana Privilege Escalation Vulnerability (GHSA-gj7m-853r-289r)
2022-10-18 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:0362-1)
2023-02-13 00:00:00
openSUSE: Security Advisory for grafana (SUSE-SU-2023:0362-1)
2024-03-04 00:00:00
cgr
cgr
CVE-2022-39229 vulnerabilities
2024-05-19 03:07:16
oraclelinux
oraclelinux
grafana security update
2023-05-24 00:00:00
grafana security and enhancement update
2023-05-15 00:00:00
redhat
redhat
(RHSA-2023:2784) Moderate: grafana security update
2023-05-16 05:54:36
(RHSA-2023:2167) Moderate: grafana security and enhancement update
2023-05-09 05:02:10
freebsd
freebsd
Grafana -- Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins
2022-06-26 00:00:00
Grafana -- Improper authentication
2022-09-07 00:00:00
Grafana -- Plugin signature bypass
2022-07-04 00:00:00
almalinux
almalinux
Moderate: grafana security update
2023-05-16 00:00:00
Moderate: grafana security and enhancement update
2023-05-09 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package grafana version 8.5.20-alt1
2023-01-31 00:00:00
redos
redos
ROS-20240404-01
2024-04-04 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - April 2023
2023-04-18 00:00:00