CVE-2022-44643

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-44643
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v171----november-14th-2022 Patch Release Notes Vendor Advisory
https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v231----november-14th-2022 Patch Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:grafana:enterprise_metrics:*:*:*:*:*:*:*:*
cpe:2.3:a:grafana:enterprise_metrics:*:*:*:*:*:*:*:*
cpe:2.3:h:amd:amd64:-:*:*:*:*:*:*:*
History

29 Dec 2022, 17:37

Type Values Removed Values Added
CWE NVD-CWE-Other
CPE cpe:2.3:a:grafana:enterprise_metrics:*:*:*:*:*:*:*:*
cpe:2.3:h:amd:amd64:-:*:*:*:*:*:*:*
First Time Grafana
Grafana enterprise Metrics
Amd
Amd amd64
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References (MISC) https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v231----november-14th-2022 - (MISC) https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v231----november-14th-2022 - Patch, Release Notes, Vendor Advisory
References (MISC) https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v171----november-14th-2022 - (MISC) https://grafana.com/docs/enterprise-metrics/v2.4.x/downloads/#v171----november-14th-2022 - Patch, Release Notes, Vendor Advisory

20 Dec 2022, 21:15

Type Values Removed Values Added
References
  • {'url': 'https://grafana.com/products/enterprise/metrics/', 'name': 'https://grafana.com/products/enterprise/metrics/', 'tags': [], 'refsource': 'MISC'}
Summary In Grafana Enterprise Metrics (GEM) before 1.7.1 and 2.x before 2.3.1, after creating an Access Policy that is granted access to all tenants as well as specified a specific label matcher, the label matcher is erroneously not propagated to queries performed with this access policy. Thus, more access is granted to the policy than intended. A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.

20 Dec 2022, 15:42

Type Values Removed Values Added
New CVE
Information

Published : 2022-12-20 15:15

Updated : 2023-12-10 14:48

NVD link : CVE-2022-44643

Mitre link : CVE-2022-44643

CVE.ORG link : CVE-2022-44643

JSON object : View

Products Affected

grafana

  • enterprise_metrics

amd

  • amd64
CWE
NVD-CWE-Other