It is possible for a malicious user who has the authorization to log into a grafana instance via an OAuth integration which provides a login name to take over the account of another user in that Grafana instance provided the following criteria are met: - the malicious user is authorized to log in to Grafana via OAuth - the malicious user's external user id is not already associated with an account in Grafana - the malicious user's email address is not already associated with an account in Grafana - the malicious user knows the Grafana username or email of the target user
Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2107435]
Upstream Advisory: https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:5720 https://access.redhat.com/errata/RHSA-2022:5720
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5716 https://access.redhat.com/errata/RHSA-2022:5716
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:5719 https://access.redhat.com/errata/RHSA-2022:5719
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:5718 https://access.redhat.com/errata/RHSA-2022:5718
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5717 https://access.redhat.com/errata/RHSA-2022:5717
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-31107
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057
This issue has been addressed in the following products: Red Hat Ceph Storage 6.1 Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642