CVE-2022-39229: Grafana users with email as a username can block other users from signing in
A flaw was found in the Grafana web application. When a user logs into the system, either the username or email address can be used. However, the login system allows both a username and connected email to be registered, which could allow an attacker to prevent a user which has an associated email address access.
Other sources
CVE-2022-39229: Using email as a username can block other users from signing in
Currently, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username.
However, the login system allows users to log in with either username or email address. Since we allow a user to log in with either their username or email address, this creates an unusual behavior where user1 can register with one email address and user2 can register his username as user1’s email address.
This prevents user1 from logging into the application since user1 password won’t match with users2 email address. This is a moderate severity security issue because it can stop a user from logging into the system.
Affected versions: Grafana <= 9.1.x
— Red Hat
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where user1 can register with one email address and user2 can register their username as user1’s email address. This prevents user1 logging into the application since user1's password won’t match with user2's email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.
Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229
We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues.
Release 9.2, latest release, also containing security fix:
- Download Grafana 9.2
Release 9.1.8, only containing security fix:
- Download Grafana 9.1.8
Release 8.5.14, only containing security fix:
- Download Grafana 8.5.14
Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.
Improper authentication - CVE-2022-39229
Summary
On September 7 as a result of an internal security audit we have discovered a security vulnerability in Grafana basic authentication, related to the usage of username and email address.
In Grafana, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user.
In addition, a user can have an email address as a username and Grafana login allows users to sign in with either username or email address. This creates an unusual behavior, where user1 can register with one email address and user2 can register their username as user1’s email address. As a result, user1 would be prevented to sign in Grafana, since user1 password won’t match with users2 email address.
The CVSS score for this vulnerability is 4.3 Moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Impacted versions
All installations for Grafana versions <=9.x, <=8.x
Solutions and mitigations
To fully address CVE-2022-39229 please upgrade your Grafana instances. Appropriate patches have been applied to Grafana Cloud.
Reporting security issues
If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is
F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA
The key is available from keyserver.ubuntu.com.
Security announcements
We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.
You can also subscribe to our RSS feed.
— GitHub
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-39229?
CVE-2022-39229 is a vulnerability found in the Grafana web application that allows one user to block another user's login attempt by registering someone else's email address as a username.
Which versions of Grafana are affected by CVE-2022-39229?
Versions prior to 9.1.8 and 8.5.14 of Grafana are affected by CVE-2022-39229.
What is the severity of CVE-2022-39229?
CVE-2022-39229 has a severity rating of medium (4) according to the National Vulnerability Database.
How can I fix CVE-2022-39229?
To fix CVE-2022-39229, users should update Grafana to version 9.1.8 or 8.5.14.
Where can I find more information about CVE-2022-39229?
More information about CVE-2022-39229 can be found at the following references: [CVE Details](https://www.cve.org/CVERecord?id=CVE-2022-39229), [National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2022-39229), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2131149), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2023:2784)