REDHAT-BUG-2131149: Medium severity grafana labs grafana oss and enterprise vulnerability
CVE-2022-39229: Using email as a username can block other users from signing in
Currently, a user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username.
However, the login system allows users to log in with either username or email address. Since we allow a user to log in with either their username or email address, this creates an unusual behavior where user1 can register with one email address and user2 can register his username as user1’s email address.
This prevents user1 from logging into the application since user1 password won’t match with users2 email address. This is a moderate severity security issue because it can stop a user from logging into the system.
Affected versions: Grafana <= 9.1.x
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2131149?
The severity of REDHAT-BUG-2131149 is classified as moderate.
How do I fix REDHAT-BUG-2131149?
To resolve REDHAT-BUG-2131149, users should update to Grafana version 9.2.x or later.
Which software is affected by REDHAT-BUG-2131149?
REDHAT-BUG-2131149 affects Grafana versions up to 9.1.x.
Can using an email address as a username lead to issues in REDHAT-BUG-2131149?
Yes, using an email address as a username in REDHAT-BUG-2131149 can block other users from signing in.
What are the implications of REDHAT-BUG-2131149 for user account management?
REDHAT-BUG-2131149 can cause complications in user account management due to the restriction on unique usernames and email addresses.