UpHeron
All vulnerabilities

Servers and applications

CVE-2022-31107

Grafana account takeover via OAuth vulnerability

Severity
High 7.5
Published
14 Jul 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.3.10, 8.4.10, 8.5.9, 9.0.3
Also known as
GHSA-mx47-6497-3fv2
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 5.3.0 before 8.3.10
  • From 8.4.0 before 8.4.10
  • From 8.5.0 before 8.5.9
  • From 9.0.0 before 9.0.3
GrafanaServers and applications · github:grafana/grafana
  • From 5.3 before 8.3.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-31107
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-31107
  • GitHub Advisory Database https://github.com/advisories/GHSA-mx47-6497-3fv2
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2