VDB
CVE-2022-39307
CVE-2022-39307
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.
EPSS 0.75% · 53.2th percentile
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.75%
53.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 0, 9.0.0 |
| Bitnami | grafana | 0, 9.0.0 |
Timeline
- Nov 8, 2022 CVE Published
- Nov 10, 2022 EPSS Score
- Dec 24, 2022 EPSS Score
- Feb 5, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 21, 2023 EPSS Score
- Jun 16, 2023 EPSS Score
- Jul 30, 2023 EPSS Score
- Sep 12, 2023 EPSS Score
- Oct 25, 2023 EPSS Score
- Dec 8, 2023 EPSS Score
- Jan 21, 2024 EPSS Score