CVE-2022-35957

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 9.1.6 and 8.5.13

Description Grafana is an open-source platform for monitoring and observability. The issue is related to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the Grafana instance. This can be exploited by a remote attacker to gain unauthorized access to information and disrupt its integrity and availability.

Recommendations For versions prior to 9.1.6 and 8.5.13, upgrade to a newer version as soon as possible. As a temporary workaround, consider deactivating auth proxy following the instructions at the official Grafana documentation.