High severity · published Nov 8, 2022
CVE-2022-39328
Grafana is an open-source platform for monitoring and observability
8.1
CVSS
1.1%
EPSS
No
On KEV
Description
Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
9.2.0 before 9.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39328
Vendor Advisory
https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221215-0003/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim
9.8
CVE-2022-28660
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used