CVE-2022-44643

Access policy with access to all tenants and using label selectors has more access

Medium · published December 21, 2022

CVSS v3.1
5.7
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.2th percentile
Published
2022-12-21T01:21Z
EPSS history
Timeline
  • 21 DEC 01:21Z
    Access policy with access to all tenants and using label selectors has more access
    cvelistv5