CVE-2022-35957

Aliases:GHSA-ff5c-938w-8c9qBIT-grafana-2022-35957GO-2024-2847
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 20 Sept 2022, 00:00
Last modified:28 Jan 2026, 04:55

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.6 MEDIUM
v3.1 (cve.org)
EPSS Score
0.88% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Sept 2022, 00:00
Published
Vulnerability first disclosed
28 Jan 2026, 04:55
Last Modified
Vulnerability information updated

Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

CVSS Metrics

  • v4.0•HIGH•Score: 7.5CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•MEDIUM•Score: 6.6CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.88%• Percentile: 76%

Techniques & Countermeasures

  • CWE-290•Authentication Bypass by Spoofing

    This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Affected Systems

  • fedoraproject•fedora

    37

  • github.com/grafana•grafana

    ≥ 9.1.0, < 9.1.6 | ≥ 9.0.0, < 9.0.9 | < 8.5.13 | all

  • grafana•grafana

    > 9.0.0, < 9.1.6 | < 8.5.13 | ≥ 9.0.0, < 9.0.9 | ≥ 9.1.0, < 9.1.6

References (7)