CVE-2022-31107 is an account takeover vulnerability in Grafana versions 5.3 through 9.0.3, 8.5.9, 8.4.10, and 8.3.10, affecting Grafana and NetApp E-Series Performance Analyzer. A malicious user with authorized OAuth access can take over another user's account if specific conditions regarding user IDs, email addresses, and knowledge of the target's Grafana username are met. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network attack vector, high attack complexity, and high impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.3.0, < 8.3.10CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 8.4.0, < 8.4.10CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 8.5.0, < 8.5.9CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.0.3CPE matchmatch criteria | cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Grafana account takeover via OAuth vulnerability
May 14, 2024grafana: OAuth account takeover
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022Account Takeover in OAuth in Grafana
Jul 14, 2022