CVE-2022-28660 | BDVDB-2026-176549 Detail

Description#

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://grafana.com/docs/enterprise-logs/latest/gel-releases/#v121----may-3-2022
https://security.netapp.com/advisory/ntap-20220707-0004/

Exploit#

No public exploit known

History#

Version 12022-05-20Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.