Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-39229 BIT-grafana-2022-39229EUVD-2024-1627GHSA-gj7m-853r-289rGO-2024-2848

Grafana users with email as a username can block other users from signing in

Published Oct 13, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

Affected products

VendorProductAffectedFixed
grafana grafana >= 9.0.0, < 9.1.8, >= 8.5.0, < 8.5.14 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 grafana 9.0.9-2.el9 RHSA-2023:2167
RHEL 8 grafana 7.5.15-4.el8 RHSA-2023:2784

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 grafana 9.0.9-2.el9 ALSA-2023:2167
AlmaLinux 8 grafana 7.5.15-4.el8 ALSA-2023:2784

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 grafana 8.5.15-150200.3.32.1 SUSE-SU-2023:0362-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2023:0353-1
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-159000.4.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-159000.4.12.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-159000.6.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 8.5.15-150000.1.39.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 mgr-osad 4.3.7-150000.1.42.1 SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 mgr-push 4.3.5-150000.1.24.2 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 4.3.5-150000.3.40.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 spacecmd 4.3.18-150000.3.92.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.3.14-150000.3.74.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 4.3.7-150000.1.30.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-4.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-4.33.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 8.5.15-1.39.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1673279145.e7616bd-1.32.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 mgr-osad 4.3.7-1.42.1 SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 mgr-push 4.3.5-1.24.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.24.0-3.6.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-3.6.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 4.3.5-21.46.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 spacecmd 4.3.18-38.115.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.3.14-52.83.1 SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.3.7-1.30.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 8.5.14-1.1 openSUSE-SU-2024:12508-1
openSUSE Leap 15.4 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2023:0353-1
openSUSE Leap 15.4 grafana 8.5.15-150200.3.32.1 SUSE-SU-2023:0362-1
openSUSE Leap 15.4 spacecmd 4.3.18-150000.3.92.1 SUSE-SU-2023:0353-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 grafana 9.0.9-2.el9 ELSA-2023-2167
Oracle Linux 8 grafana 7.5.15-4.el8 ELSA-2023-2784

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 8.5.14 8.5.14 GHSA-gj7m-853r-289r
Go github.com/grafana/grafana >= 9.0.0, < 9.1.8 9.1.8 GHSA-gj7m-853r-289r
Go github.com/grafana/grafana all versions — GO-2024-2848

Advisories 13

References