Blog  /  Engineering

Grafana security releases: New versions with fixes for CVE-2022-39229, CVE-2022-39201, CVE-2022-31130, CVE-2022-31123

October 12, 2022 4 min

On Oct. 11, we released Grafana 9.2.0, which introduced features such as a new Grafana panel help option and a simplified variable editor for Grafana Loki. In addition, the 9.2 release includes some bug fixes as well as security fixes for CVE-2022-39229, CVE-2022-39201, CVE-2022-31130, CVE-2022-31123.

We have also released security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.

Release 9.2, latest release with security fix:

Release 9.1.8, only containing security fix:

Release 8.5.14, only containing security fix:

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure Managed Grafana as a service offering.

Improper authentication (CVE-2022-39229)

Summary of CVE-2022-39229

On September 7, as a result of an internal security audit, we discovered a security vulnerability in Grafana’s basic authentication related to the usage of username and email address.

In Grafana, a user’s username and email address are unique fields, which means no other user can have the same username or email address as another user.

In addition, a user can have an email address as a username, and the Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where user_1 can register with one email address and user_2 can register their username as user_1’s email address. As a result, user_1 would be prevented from signing in to Grafana, since user_1 password won’t match with user_2 email address.

The CVSS score for this vulnerability is 4.3 moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Impacted versions

All installations for Grafana versions <=9.x, <=8.x.

Solutions and mitigations

To fully address CVE-2022-39229, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

Summary of CVE-2022-39201

On September 7, as a result of an internal security audit, we discovered that Grafana could leak the authentication cookie of users to plugins. After further analysis, we learned that the vulnerability impacts data source and plugin proxy endpoints under certain conditions.

This is a CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) medium severity vulnerability.

Impact

The destination plugin could receive a Grafana authentication cookie of the user.

Impacted versions

All installations for Grafana versions >= v5.0.0-beta1

Solutions and mitigations

To fully address CVE-2022-39201, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130)

Summary of CVE-2022-31130

On June 26, a security researcher contacted Grafana Labs to disclose a vulnerability with the GitLab data source plugin that could leak the API key to GitLab. After further analysis, we learned that the vulnerability impacts data source and plugin proxy endpoints with authentication tokens but under some conditions.

This is a CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) medium severity vulnerability.

Impact

The destination plugin could receive a Grafana authentication token of the user.

Impacted versions

All installations for Grafana versions <=9.x, <=8.x, <=7.x

Solutions and mitigations

To fully address CVE-2022-31130, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

As a workaround do not use API keys, JWT authentication, or any HTTP Header-based authentication.

Plugin signature bypass (CVE-2022-31123)

Summary of CVE-2022-31123

On July 4, as a result of an internal security audit, we discovered a bypass in the plugin signature verification by exploiting a versioning flaw.

This is a CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) medium severity vulnerability.

Impact

An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed.

Impacted versions

All installations for Grafana versions <=9.x, <=8.x, <=7.x

Solutions and mitigations

To fully address CVE-2022-31123, please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.

Reporting security issues

If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs’ open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.