CVE-2022-28660

9.8

CRITICALCVSS v3

Published

May 20, 2022

CVSS v2

7.5 HIGH

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode

grafana/grafana

GitHubThe open and composable observability and data visualization platform. Visualize metrics, logs, and traces from multiple sources like Prometheus, Loki, Elasticsearch, InfluxDB, Postgres and many more.

>= 1.1.0, < 1.2.1, = 1.3.0NVD

grafana/grafana

Docker HubThe official Grafana docker container

>= 1.1.0, < 1.2.1, = 1.3.0NVD

Grafana

More on this CVE

NVD↗GitHub Advisory↗

ChocolateyGrafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB. **Please Note**: This is an automatically updated package. If you find it is out of date by more than a day or two, please contact the maintainer(s) and let them know [here](https://github.com/mkevenaar/chocolatey-packages/issues) that the package is no longer updating correctly.

>= 1.1.0, < 1.2.1, = 1.3.0NVD

grafana

Python Package Indexgrafana

>= 1.1.0, < 1.2.1, = 1.3.0NVD

grafana

RubyGemsA simple wrapper for the Grafana HTTP API

>= 1.1.0, < 1.2.1, = 1.3.0NVD

grafana

NPMThis is a placeholder Grafana.com project for @types/grafana

>= 1.1.0, < 1.2.1, = 1.3.0NVD

Security Advisories

CVE-2022-28660

Description

More on this CVE