CVE-2022-44643 - CVE House
Back to Database
Status published Medium CVE-2022-44643

Access policy with access to all tenants and using label selectors has more access

Vulnerability Description

A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-44643

Credits & Attribution

No credits recorded in the NVD database.

References

More from grafana

View All →
CVE-2023-22462
Stored XSS in Grafana Text plugin
Medium 6.4
CVE-2022-46156
Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
High 7.2
CVE-2022-39328
Grafana vulnerable to race condition allowing privilege escalation
Critical 9.8
CVE-2022-39324
Grafana vulnerable to spoofing originalUrl of snapshots
Medium 6.7
CVE-2022-39307
Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
Medium 6.7

Affected Vendor

Affected Software

enterprise metrics
Vulnerable Versions:
1.0.0, 2.0.0

Timeline

Official Publish: December 21st, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.