-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | >= 9.1.0, < 9.1.6 | 9.1.6 |
| github.com/grafana/grafana | go | >= 9.0.0, < 9.0.9 | 9.0.9 |
| github.com/grafana/grafana | go | < 8.5.13 | 8.5.13 |
Datasource proxy breaks this assumption:
X-WEBAUTH-USER HTTP header containing admin username.The CVSS score for this vulnerability is 6.6 Moderate (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
All Grafana installations where the Auth Proxy is used.
To fully address CVE-2022-35957 please upgrade your Grafana instances. They are only required if you are using Auth proxy. If you can’t upgrade, as an alternative, you can deactivate the auth proxy.
Appropriate patches have been applied to Grafana Cloud.
Here is a timeline starting from when we originally learned of the issue.
If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is
F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA
The key is available from keyserver.ubuntu.com.
We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.
You can also subscribe to our RSS feed.
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the datasource proxy feature improperly trusting user-controlled headers (X-WEBAUTH-USER) when making requests to localhost. The proxyRequests function is responsible for forwarding these requests and headers. Since it didn't sanitize privileged headers for internal requests, attackers could escalate privileges by configuring a malicious datasource pointing to localhost with forged auth headers. The CWE-290 classification and vulnerability description directly implicate the header handling in datasource proxy functionality.
KEV Misses 88% of Exploited CVEs- Get the report