What is CVE-2022-39307?

CVE-2022-39307 is a medium-severity vulnerability in Grafana, classified under Information Disclosure. CVSS score: 6.7/10. Published 2022-11-09.

How severe is CVE-2022-39307?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Information disclosure in Grafana

CVE-2022-39307

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.

Vulnerability class: Information Disclosure

EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L.

Affected products

Grafana — versions >= v9.0.0-beta1, < 9.2.4, < 8.5.15

Weakness classification (CWE)

References

security-advisories@github.com (Vendor Advisory)
security-advisories@github.com (Third Party Advisory)

Frequently asked questions

What is CVE-2022-39307?: CVE-2022-39307 is a medium-severity vulnerability in Grafana, classified under Information Disclosure. CVSS score: 6.7/10. Published 2022-11-09.
How severe is CVE-2022-39307?: Medium severity. CVSS v3 base score is 6.7 out of 10.