Detections
Analytics
SCA: security update for github.com/grafana/grafana (GHSA-mx47-6497-3fv2)
high Tenable Self-Hosted Container Security Plugin ID 434639
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,
8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana
instance via a configured OAuth IdP which provides a login name to take over the account of another user
in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via
OAuth, the malicious user's external user id is not already associated with an account in Grafana, the
malicious user's email address is not already associated with an account in Grafana, and the malicious
user knows the Grafana username of the target user. If these conditions are met, the malicious user can
set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log
in to Grafana. Due to the way that external and internal user accounts are linked together during login,
if the conditions above are all met then the malicious user will be able to log in to the target user's
Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a
workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users
authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
(CVE-2022-31107)
See Also
Plugin Details
Severity: High
ID: 434639
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.86
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2022-31107
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 7.6
Threat Score: 5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/14/2024
Vulnerability Publication Date: 7/15/2022
Reference Information
CVE: CVE-2022-31107
cwe: CWE-863