Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less     than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an     unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4.
    There are no known workarounds. (CVE-2022-39328)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less
    than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an
    unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4.
    There are no known workarounds. (CVE-2022-39328)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory.

  - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less     than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an     unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4.
    There are no known workarounds. (CVE-2022-39328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
260617	Linux Distros Unpatched Vulnerability : CVE-2022-39328	Nessus	Misc.	high
434005	SCA: security update for github.com/grafana/grafana (GHSA-vqc4-mpj8-jxch)	Tenable Cloud Security	SCA Checks	critical
434005	SCA: security update for github.com/grafana/grafana (GHSA-vqc4-mpj8-jxch)	Tenable Self-Hosted Container Security	SCA Checks	critical
167325	FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2022-39328

critical

Tenable Plugins

high

critical

critical

high