CVE-2022-39307

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 8.5.15 Grafana versions 9.0.0 through 9.2.3

Description Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the "/api/user/password/sent-reset-email" URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk.

Recommendations For Grafana versions prior to 8.5.15, update to version 8.5.15 or later. For Grafana versions 9.0.0 through 9.2.3, update to version 9.2.4 or later. As a temporary workaround, consider restricting access to the /api/user/password/sent-reset-email API endpoint until a patch is available.