CVE-2022-28660: Critical severity grafana labs grafana oss and enterprise vulnerability
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-28660?
CVE-2022-28660 is a vulnerability in Grafana Enterprise Logs that allows unauthenticated access when X-Scope-OrgID is used.
Which versions of Grafana Enterprise Logs are affected by CVE-2022-28660?
Versions 1.1.x through 1.3.x before 1.4.0 of Grafana Enterprise Logs are affected by CVE-2022-28660.
How severe is CVE-2022-28660?
CVE-2022-28660 has a severity rating of 9.8 (critical).
How can I fix CVE-2022-28660?
To fix CVE-2022-28660, update to version 1.2.1, 1.3.1, or 1.4.0 of Grafana Enterprise Logs.
Where can I find more information about CVE-2022-28660?
You can find more information about CVE-2022-28660 at the following references: [link 1](https://grafana.com/docs/enterprise-logs/latest/gel-releases/#v121----may-3-2022) and [link 2](https://security.netapp.com/advisory/ntap-20220707-0004/).