CVE-2022-31107: 
Grafana vulnerability analysis and mitigation

CVE-2022-31107 is a high severity OAuth account takeover vulnerability affecting Grafana versions prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10. The vulnerability was discovered on June 27, 2022, by the HTTPVoid team and disclosed to Grafana Labs. It affects all Grafana versions from 5.3 onwards (GitHub Security Advisory).

The vulnerability allows a malicious user who has authorization to log into a Grafana instance via a configured OAuth Identity Provider (IdP) to potentially take over an existing Grafana account under certain conditions. The vulnerability has been assigned a CVSS score of 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) indicating high severity (GitHub Security Advisory).

Successful exploitation of this vulnerability could lead to account takeover, allowing unauthorized access to sensitive information, addition or modification of data, and potential service disruption (NetApp Security).

The vulnerability requires the attacker to have authorization to log into the Grafana instance through a configured OAuth IdP that provides a login name. While public discussion of this vulnerability exists, specific exploit details are not publicly available (GitHub Security Advisory).

The primary mitigation is to upgrade to the patched versions: Grafana 9.0.3, 8.5.9, 8.4.10, or 8.3.10. As a workaround, administrators can either disable OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address (GitHub Security Advisory).