Grafana account takeover via OAuth vulnerability
Résumé
Grafana account takeover via OAuth vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.
Release v.9.0.3, containing this security fix and other patches:
Release v.8.5.9, containing this security fix and other fixes:
Release v.8.4.10, containing this security fix and other fixes:
Release v.8.3.10, containing this security fix and other fixes:
Grafana account takeover via OAuth vulnerability (CVE-2022-31107)
Summary
On June 27 the HTTPVoid team contacted Grafana Labs to disclose a Grafana account takeover via an OAuth vulnerability.
We believe that this vulnerability is rated at CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).
Impact
It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP t…
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory grafana.com
- advisory grafana.com
- advisory grafana.com
- advisory security.netapp.com
- advisory nvd.nist.gov
- package github.com
- web github.com
- web grafana.com
- web grafana.com
- web grafana.com
- web security.netapp.com