Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Grafana Vulnerability - CVE-2022-39307 - Vulnerability Database
Grafana

Grafana Vulnerability - CVE-2022-39307

Medium
Reference: CVE-2022-39307
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2022-39307
Title: Grafana Vulnerability
Overview:

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist a JSON response contains a user not found message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.