Grafana up to 8.5.14/9.2.3 Email Invite input validation

Summaryinfo

A vulnerability was found in Grafana up to 8.5.14/9.2.3. It has been classified as critical. This vulnerability affects unknown code of the component Email Invite Handler. This manipulation causes input validation. This vulnerability is tracked as CVE-2022-39306. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in Grafana up to 8.5.14/9.2.3. Affected by this vulnerability is an unknown code block of the component Email Invite Handler. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.

The weakness was disclosed 11/10/2022 as GHSA-2x6g-h2hg-rq84. The advisory is shared at github.com. This vulnerability is known as CVE-2022-39306 since 09/02/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 8.5.15 or 9.2.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-1372). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Grafana

Version

• 8.5.0
• 8.5.1
• 8.5.2
• 8.5.3
• 8.5.4
• 8.5.5
• 8.5.6
• 8.5.7
• 8.5.8
• 8.5.9
• 8.5.10
• 8.5.11
• 8.5.12
• 8.5.13
• 8.5.14
• 9.2.0
• 9.2.1
• 9.2.2
• 9.2.3

License

• open-source

Website

• Product: https://github.com/grafana/grafana/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion