Skip to content
Fencer Vulns
high 7.1

CVE-2022-31107 json

Grafana account takeover via OAuth vulnerability

published 2022-07-15 4 y ago modified 2026-09-10 1 mo ago also BIT-grafana-2022-31107 , EUVD-2024-1698 , GHSA-mx47-6497-3fv2 , GO-2024-2852

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Patch / fix

  • go github.com/grafana/grafana 8.3.10, 8.4.10, 8.5.9, 9.0.3
  • bitnami grafana 8.3.10, 8.4.10, 8.5.9, 9.0.3
  • grafana grafana 8.3.10, 8.4.10, 8.5.9, 9.0.3
  • grafana RHEL 9 7.5.11-5.el9_0
  • grafana RHEL 8 7.5.11-3.el8_6
  • grafana RHEL 8.2 EUS 6.3.6-5.el8_2
  • grafana-loki RHEL 8.2 EUS 6.3.6-5.el8_2
  • grafana-mssql RHEL 8.2 EUS 6.3.6-5.el8_2
  • grafana-mysql RHEL 8.2 EUS 6.3.6-5.el8_2
  • grafana-graphite RHEL 8.2 EUS 6.3.6-5.el8_2
  • grafana-influxdb RHEL 8.2 EUS 6.3.6-5.el8_2

red hat advisories RHSA-2022:5719RHSA-2022:5720RHSA-2022:5716RHSA-2022:5717RHSA-2022:5718

  • rhnlib Manager Client Tools 15-BETA 5.0.1-159000.6.30.1
  • ansible Manager Client Tools 15-BETA 2.9.27-159000.3.9.1
  • grafana Manager Client Tools 15-BETA 9.5.8-159000.4.24.1
  • mgr-push Manager Client Tools 15-BETA 5.0.1-159000.4.21.1
  • spacecmd Manager Client Tools 15-BETA 5.0.1-159000.6.42.1
  • python-hwdata Manager Client Tools 15-BETA 2.3.5-159000.5.13.1
  • python-pyvmomi Manager Client Tools 15-BETA 6.7.3-159000.3.6.1
  • dracut-saltboot Manager Client Tools Beta for SLE Micro 5, Manager Client Tools 15-BETA 0.1.1681904360.84ef141-159000.3.30.1

suse advisories SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2023:2579-1SUSE-SU-2023:2578-1SUSE-SU-2023:2575-1SUSE-SU-2022:4439-1

  • grafana openSUSE Tumbleweed 8.3.10-1.1

opensuse advisories openSUSE-SU-2024:12260-1

  • grafana AlmaLinux 9 7.5.11-5.el9_0
  • grafana AlmaLinux 8 7.5.11-3.el8_6

almalinux advisories ALSA-2022:5716ALSA-2022:5717

  • grafana Rocky Linux 8 7.5.11-3.el8_6
  • grafana Rocky Linux 9 7.5.11-5.el9_0

rocky linux advisories RLSA-2022:5717RLSA-2022:5716

  • grafana Alpine 3.16 8.5.9-r0
  • grafana Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 9.0.3-r0

alpine advisories ALPINE-CVE-2022-31107

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-31107 updated cvss 7.1

grafana: OAuth account takeover

  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana Red Hat Ceph Storage 3 grafana Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Storage 3 grafana
    affected: workaround, no fix available “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.”
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2023:3642
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 7.5.11-3.el8_6
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2022:5717
  • Red Hat Enterprise Linux AppStream (v. 9) grafana 7.5.11-5.el9_0
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2022:5716
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) grafana 6.2.2-9.el8_1, grafana-loki 6.2.2-9.el8_1, grafana-mssql 6.2.2-9.el8_1, grafana-mysql 6.2.2-9.el8_1, grafana-graphite 6.2.2-9.el8_1, grafana-influxdb 6.2.2-9.el8_1, +7 more
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2022:5720
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) grafana 6.3.6-5.el8_2, grafana-loki 6.3.6-5.el8_2, grafana-mssql 6.3.6-5.el8_2, grafana-mysql 6.3.6-5.el8_2, grafana-graphite 6.3.6-5.el8_2, grafana-influxdb 6.3.6-5.el8_2, +7 more
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2022:5719
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) grafana 7.3.6-5.el8_4
    fixed: vendor fix “As a workaround, it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.” RHSA-2022:5718
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel8 Red Hat build of Quarkus grafana Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-177, rhceph/keepalived-rhel9 2.2.4-3, rhceph/snmp-notifier-rhel9 1.2.1-36, rhceph/rhceph-haproxy-rhel9 2.4.17-4, rhceph/rhceph-promtail-rhel9 v2.4.0-5 Red Hat OpenShift Container Platform 4 openshift4/ose-grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

2.87% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
GitHub 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
>=5.3.0-beta1, <8.3.10
>=8.4.0, <8.4.10
>=8.5.0, <8.5.9
>=9.0.0, <9.0.3
all versions
8.3.10
8.4.10
8.5.9
9.0.3
bitnami grafana
>=5.3.0, <8.3.10
>=8.4.0, <8.4.10
>=8.5.0, <8.5.9
>=9.0.0, <9.0.3
8.3.10
8.4.10
8.5.9
9.0.3

Affected products

  • grafana grafana

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.