Grafana security releases: New versions with fixes for CVE-2022-39229, CVE-2022-39201, CVE-2022-31130, CVE-2022-31123
On Oct. 11, we released Grafana 9.2.0, which introduced features such as a new Grafana panel help option and a simplified variable editor for Grafana Loki. In addition, the 9.2 release includes some bug fixes as well as security fixes for CVE-2022-39229, CVE-2022-39201, CVE-2022-31130, CVE-2022-31123.
We have also released security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.
Release 9.2, latest release with security fix:
Release 9.1.8, only containing security fix:
Release 8.5.14, only containing security fix:
Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure Managed Grafana as a service offering.
Improper authentication (CVE-2022-39229)
Summary of CVE-2022-39229
On September 7, as a result of an internal security audit, we discovered a security vulnerability in Grafana’s basic authentication related to the usage of username and email address.
In Grafana, a user’s username and email address are unique fields, which means no other user can have the same username or email address as another user.
In addition, a user can have an email address as a username, and the Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where user_1 can register with one email address and user_2 can register their username as user_1’s email address. As a result, user_1 would be prevented from signing in to Grafana, since user_1 password won’t match with user_2 email address.
The CVSS score for this vulnerability is 4.3 moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Impacted versions
All installations for Grafana versions <=9.x, <=8.x.
Solutions and mitigations
To fully address CVE-2022-39229, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.
Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201)
Summary of CVE-2022-39201
On September 7, as a result of an internal security audit, we discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis, we learned that the vulnerability impacts data source and plugin proxy endpoints under certain conditions.
This is a CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) medium severity vulnerability.
Impact
The destination plugin could receive a Grafana authentication cookie of the user.
Impacted versions
All installations for Grafana versions >= v5.0.0-beta1
Solutions and mitigations
To fully address CVE-2022-39201, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.
Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)
Summary of CVE-2022-31130
On June 26, a security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis, we learned that the vulnerability impacts data source and plugin proxy endpoints with authentication tokens but under some conditions.
This is a CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) medium severity vulnerability.
Impact
The destination plugin could receive a Grafana authentication token of the user.
Impacted versions
All installations for Grafana versions <=9.x, <=8.x, <=7.x
Solutions and mitigations
To fully address CVE-2022-31130, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.
As a workaround do not use API keys, JWT authentication, or any HTTP Header-based authentication.
Plugin signature bypass (CVE-2022-31123)
Summary of CVE-2022-31123
On July 4, as a result of an internal security audit, we discovered a bypass in the plugin signature verification by exploiting a versioning flaw.
This is a CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) medium severity vulnerability.
Impact
An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed.
Impacted versions
All installations for Grafana versions <=9.x, <=8.x, <=7.x
Solutions and mitigations
To fully address CVE-2022-31123, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.
Reporting security issues
If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs’ open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is
F225E 6A9B BB15 A37E 95EB 6312 C66A 51CC B44C 27E0
The key is available from keyserver.ubuntu.com.
Security announcements
We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.
You can also subscribe to our RSS feed.
