High severity · published Dec 20, 2022
CVE-2022-44643
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Enterprise Metrics · Grafana
1.0.0 before 1.7.1; 2.0.0 before 2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-44643
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-44643
Patch
https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v171----november-14th-2022
Patch
https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v231----november-14th-2022
More from Enterprise Metrics
5.5
CVE-2021-31231
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is…