Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fvta-uqdk-37fd
Vulnerability ID VCID-fvta-uqdk-37fd
Aliases CVE-2022-39307
GHSA-3p62-42x7-gxg5
Summary Grafana User enumeration via forget password Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - [Download Grafana 9.2.4](https://grafana.com/grafana/download/9.2.4) Release 8.5.15, only containing security fix: - [Download Grafana 8.5.15](https://grafana.com/grafana/download/8.5.15) Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure Managed Grafana as a service offering. ## Username enumeration ### Summary When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a “user not found” message. The CVSS score for this vulnerability is [5.3 Moderate](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N&version=3.1) ### Impact The impacted endpoint leaks information to unauthenticated users and introduces a security risk. ### Impacted versions All installations for Grafana versions Grafana <=9.x, <8.x ### Solutions and mitigations To fully address CVE-2022-39307, please upgrade your Grafana instances. Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud). ## Reporting security issues If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA The key is available from keyserver.ubuntu.com. ## Security announcements We maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes. You can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-209 Generation of Error Message Containing Sensitive Information
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39307.json
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00194 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2022-39307
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.7 https://github.com/grafana/grafana
cvssv4 7.3 https://github.com/grafana/grafana
generic_textual HIGH https://github.com/grafana/grafana
cvssv3.1 6.7 https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
cvssv4 7.3 https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
generic_textual HIGH https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
ssvc Track https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
cvssv3.1 6.7 https://nvd.nist.gov/vuln/detail/CVE-2022-39307
cvssv4 7.3 https://nvd.nist.gov/vuln/detail/CVE-2022-39307
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-39307
cvssv3.1 6.7 https://security.netapp.com/advisory/ntap-20221215-0004
cvssv4 7.3 https://security.netapp.com/advisory/ntap-20221215-0004
generic_textual HIGH https://security.netapp.com/advisory/ntap-20221215-0004
cvssv3.1 6.7 https://security.netapp.com/advisory/ntap-20221215-0004/
ssvc Track https://security.netapp.com/advisory/ntap-20221215-0004/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39307.json
https://api.first.org/data/v1/epss?cve=CVE-2022-39307
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/grafana/grafana
https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
https://nvd.nist.gov/vuln/detail/CVE-2022-39307
https://security.netapp.com/advisory/ntap-20221215-0004
2138015 https://bugzilla.redhat.com/show_bug.cgi?id=2138015
ntap-20221215-0004 https://security.netapp.com/advisory/ntap-20221215-0004/
RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642
RHSA-2023:6420 https://access.redhat.com/errata/RHSA-2023:6420
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-39307.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/grafana/grafana
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/grafana/grafana
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:47:00Z/ Found at https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2022-39307
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-39307
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://security.netapp.com/advisory/ntap-20221215-0004
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Found at https://security.netapp.com/advisory/ntap-20221215-0004
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://security.netapp.com/advisory/ntap-20221215-0004/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-23T15:47:00Z/ Found at https://security.netapp.com/advisory/ntap-20221215-0004/
Exploit Prediction Scoring System (EPSS)
Percentile 0.41328
EPSS Score 0.00194
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:54.450943+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3p62-42x7-gxg5/GHSA-3p62-42x7-gxg5.json 38.0.0