Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Grafana Authentication Bypass by Spoofing Vulnerability - CVE-2022-35957 - Vulnerability Database
Grafana

Grafana Authentication Bypass by Spoofing Vulnerability - CVE-2022-35957

Medium
Reference: CVE-2022-35957
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-35957
Title: Grafana Authentication Bypass by Spoofing Vulnerability
Overview:

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/