CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-39328
High (8.1) in grafana grafana. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 9.2.4.
Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-362
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vqc4-mpj8-jxch | Go | github.com/grafana/grafana | >=9.2.0 <9.2.4 | 9.2.4 |
| GO-2024-2856 | Go | github.com/grafana/grafana | all versions | no fix published |