Vulnerability-Lookup

CVE-2022-31097 (GCVE-0-2022-31097)

Vulnerability from cvelistv5 – Published: 2022-07-15 12:10 – Updated: 2026-01-28 04:55

Title

Stored XSS in Grafana's Unified Alerting

Summary

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-27 00:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/grafana/grafana/security/advis…	x_refsource_CONFIRM
https://grafana.com/docs/grafana/latest/release-n…	x_refsource_MISC
https://grafana.com/docs/grafana/next/release-not…	x_refsource_MISC
https://grafana.com/docs/grafana/latest/release-n…	x_refsource_MISC
https://security.netapp.com/advisory/ntap-2022090…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
grafana	grafana	Affected: >= 9.0.0, < 9.0.3 Affected: >= 8.5.0, < 8.5.9 Affected: >= 8.4.0, < 8.4.10 Affected: >= 8.0.0, < 8.3.10	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:11:38.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31097",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-28T04:55:34.182Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grafana",
          "vendor": "grafana",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.5.0, \u003c 8.5.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.4.0, \u003c 8.4.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.3.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-01T13:06:34.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
        }
      ],
      "source": {
        "advisory": "GHSA-vw7q-p2qg-4m5f",
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS in Grafana\u0027s Unified Alerting",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-31097",
          "STATE": "PUBLIC",
          "TITLE": "Stored XSS in Grafana\u0027s Unified Alerting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "grafana",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 9.0.0, \u003c 9.0.3"
                          },
                          {
                            "version_value": "\u003e= 8.5.0, \u003c 8.5.9"
                          },
                          {
                            "version_value": "\u003e= 8.4.0, \u003c 8.4.10"
                          },
                          {
                            "version_value": "\u003e= 8.0.0, \u003c 8.3.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "grafana"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f",
              "refsource": "CONFIRM",
              "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
            },
            {
              "name": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/",
              "refsource": "MISC",
              "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
            },
            {
              "name": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/",
              "refsource": "MISC",
              "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
            },
            {
              "name": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/",
              "refsource": "MISC",
              "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220901-0010/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vw7q-p2qg-4m5f",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-31097",
    "datePublished": "2022-07-15T12:10:10.000Z",
    "dateReserved": "2022-05-18T00:00:00.000Z",
    "dateUpdated": "2026-01-28T04:55:34.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-31097",
      "date": "2026-09-19",
      "epss": "0.68603",
      "percentile": "0.99306"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "38231605-A82E-4D32-893D-69A2FE01F808",
                  "versionEndExcluding": "8.3.10",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A5136FB0-D7F8-4BDD-9C70-CB2648065A1F",
                  "versionEndExcluding": "8.4.10",
                  "versionStartIncluding": "8.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7C2FAADE-D9EA-431C-ACFA-9F846F14B5A2",
                  "versionEndExcluding": "8.5.9",
                  "versionStartIncluding": "8.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A29E8B3E-D3A9-49A4-ABCD-4E87F8B527DD",
                  "versionEndExcluding": "9.0.3",
                  "versionStartIncluding": "9.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
        },
        {
          "lang": "es",
          "value": "Grafana es una plataforma de c\u00f3digo abierto para la monitorizaci\u00f3n y la observaci\u00f3n. Las versiones de la rama 8.x y 9.x anteriores a 9.0.3, 8.5.6, 8.4.10 y 8.3.10, son vulnerables a un ataque de tipo cross-site scripting almacenado por medio de la funci\u00f3n Unified Alerting de Grafana. Un atacante puede explotar esta vulnerabilidad para escalar el privilegio de editor a administrador al enga\u00f1ar a un administrador autenticado para que haga clic en un enlace. Las versiones 9.0.3, 8.5.6, 8.4.10 y 8.3.10 contienen un parche. Como mitigaci\u00f3n, es posible deshabilitar las alertas o usar las alertas heredadas"
        }
      ],
      "id": "CVE-2022-31097",
      "lastModified": "2024-11-21T07:03:53.317",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.1,
            "impactScore": 5.2,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.3,
            "impactScore": 5.8,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2022-07-15T12:15:08.903",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Third Party Advisory"
          ],
          "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes",
            "Vendor Advisory"
          ],
          "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "grafana",
                "vendor": "grafana",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 9.0.0, \u003c 9.0.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.5.0, \u003c 8.5.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.4.0, \u003c 8.4.10"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 8.0.0, \u003c 8.3.10"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38231605-A82E-4D32-893D-69A2FE01F808",
                    "versionEndExcluding": "8.3.10",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A5136FB0-D7F8-4BDD-9C70-CB2648065A1F",
                    "versionEndExcluding": "8.4.10",
                    "versionStartIncluding": "8.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7C2FAADE-D9EA-431C-ACFA-9F846F14B5A2",
                    "versionEndExcluding": "8.5.9",
                    "versionStartIncluding": "8.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A29E8B3E-D3A9-49A4-ABCD-4E87F8B527DD",
                    "versionEndExcluding": "9.0.3",
                    "versionStartIncluding": "9.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
          },
          {
            "lang": "es",
            "value": "Grafana es una plataforma de c\u00f3digo abierto para la monitorizaci\u00f3n y la observaci\u00f3n. Las versiones de la rama 8.x y 9.x anteriores a 9.0.3, 8.5.6, 8.4.10 y 8.3.10, son vulnerables a un ataque de tipo cross-site scripting almacenado por medio de la funci\u00f3n Unified Alerting de Grafana. Un atacante puede explotar esta vulnerabilidad para escalar el privilegio de editor a administrador al enga\u00f1ar a un administrador autenticado para que haga clic en un enlace. Las versiones 9.0.3, 8.5.6, 8.4.10 y 8.3.10 contienen un parche. Como mitigaci\u00f3n, es posible deshabilitar las alertas o usar las alertas heredadas"
          }
        ],
        "id": "CVE-2022-31097",
        "lastModified": "2026-06-17T04:44:47.433",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 5.8,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-31097",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-07-15T12:15:08.903",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Third Party Advisory"
            ],
            "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes",
              "Vendor Advisory"
            ],
            "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-14T06:45:59+00:00",
      "cve": "CVE-2022-31097",
      "id": "CVE-2022-31097",
      "initial_release_date": "2022-07-14T00:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "11",
      "product_status:known_not_affected": "35",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "grafana: stored XSS vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31097.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-09-29T01:01:35Z",
      "cve": "CVE-2022-31097",
      "id": "CVE-2022-31097",
      "initial_release_date": "2023-02-15T03:25:46Z",
      "product_status:known_not_affected": "5",
      "product_status:recommended": "17",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-31097",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-31097.json",
      "version": "13"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T07:11:38.469Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
              },
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
              },
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
              },
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
              },
              {
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-31097",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-23T15:51:25.770174Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-23T15:51:27.343Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "grafana",
              "vendor": "grafana",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 9.0.0, \u003c 9.0.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.5.0, \u003c 8.5.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.4.0, \u003c 8.4.10"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 8.0.0, \u003c 8.3.10"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2022-09-01T13:06:34.000Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
            },
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
            },
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
            },
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
            },
            {
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
            }
          ],
          "source": {
            "advisory": "GHSA-vw7q-p2qg-4m5f",
            "discovery": "UNKNOWN"
          },
          "title": "Stored XSS in Grafana\u0027s Unified Alerting",
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "security-advisories@github.com",
              "ID": "CVE-2022-31097",
              "STATE": "PUBLIC",
              "TITLE": "Stored XSS in Grafana\u0027s Unified Alerting"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "grafana",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "\u003e= 9.0.0, \u003c 9.0.3"
                              },
                              {
                                "version_value": "\u003e= 8.5.0, \u003c 8.5.9"
                              },
                              {
                                "version_value": "\u003e= 8.4.0, \u003c 8.4.10"
                              },
                              {
                                "version_value": "\u003e= 8.0.0, \u003c 8.3.10"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "grafana"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting."
                }
              ]
            },
            "impact": {
              "cvss": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f",
                  "refsource": "CONFIRM",
                  "url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
                },
                {
                  "name": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/",
                  "refsource": "MISC",
                  "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/"
                },
                {
                  "name": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/",
                  "refsource": "MISC",
                  "url": "https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/"
                },
                {
                  "name": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/",
                  "refsource": "MISC",
                  "url": "https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/"
                },
                {
                  "name": "https://security.netapp.com/advisory/ntap-20220901-0010/",
                  "refsource": "CONFIRM",
                  "url": "https://security.netapp.com/advisory/ntap-20220901-0010/"
                }
              ]
            },
            "source": {
              "advisory": "GHSA-vw7q-p2qg-4m5f",
              "discovery": "UNKNOWN"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2022-31097",
        "datePublished": "2022-07-15T12:10:10.000Z",
        "dateReserved": "2022-05-18T00:00:00.000Z",
        "dateUpdated": "2026-01-28T04:55:34.182Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

OESA-2025-1189 (CVE-2022-31097)

Vulnerability from osv_openeuler – Published: 2025-02-28 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

grafana security update

Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.(CVE-2022-39306)

Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the /api/user/password/sent-reset-email URL. When the username or email does not exist, a JSON response contains a “user not found” message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.(CVE-2022-39307)

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the originalUrl parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The Open original dashboard button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.(CVE-2022-39324)

Severity

8.7 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-31097	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-31123	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-31130	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-35957	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-36062	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-39201	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-39306	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-39307	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-39324	ADVISORY

JSON

To clipboard

{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"grafana-9.2.10-1.oe2203sp4.aarch64.rpm",
"grafana-debuginfo-9.2.10-1.oe2203sp4.aarch64.rpm",
"grafana-debugsource-9.2.10-1.oe2203sp4.aarch64.rpm",
"grafana-selinux-9.2.10-1.oe2203sp4.aarch64.rpm"
],
"src": [
"grafana-9.2.10-1.oe2203sp4.src.rpm"
],
"x86_64": [
"grafana-9.2.10-1.oe2203sp4.x86_64.rpm",
"grafana-debuginfo-9.2.10-1.oe2203sp4.x86_64.rpm",
"grafana-debugsource-9.2.10-1.oe2203sp4.x86_64.rpm",
"grafana-selinux-9.2.10-1.oe2203sp4.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS-SP4",
"name": "grafana",
"purl": "pkg:rpm/openEuler/grafana\u0026distro=openEuler-22.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.10-1.oe2203sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026amp;amp; OpenTSDB.\r\n\r\nSecurity Fix(es):\n\nGrafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)\n\nGrafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)\n\nGrafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user\u0026apos;s Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)\n\nGrafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)\n\nGrafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)\n\nGrafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user\u0026apos;s Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)\n\nGrafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.(CVE-2022-39306)\n\nGrafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, a JSON response contains a \u201cuser not found\u201d message. This leaks information to unauthenticated users and introduces a security risk. This issue has been patched in 9.2.4 and backported to 8.5.15. There are no known workarounds.(CVE-2022-39307)\n\nGrafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker\u2019s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.(CVE-2022-39324)",
"id": "OESA-2025-1189",
"modified": "2026-08-06T11:08:17Z",
"published": "2025-02-28T11:08:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1189"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31097"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31123"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31130"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35957"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36062"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39201"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39306"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39307"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39324"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "grafana security update",
"upstream": [
"CVE-2022-31097",
"CVE-2022-31123",
"CVE-2022-31130",
"CVE-2022-35957",
"CVE-2022-36062",
"CVE-2022-39201",
"CVE-2022-39306",
"CVE-2022-39307",
"CVE-2022-39324"
]
}

OPENSUSE-SU-2024:12260-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

grafana-8.3.10-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 4 products

Open the full advisory

RHSA-2023:3642

Vulnerability from csaf_redhat - Published: 2023-06-15 15:59 - Updated: 2026-09-19 17:43

Summary

Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update

Severity

Important

Scope

35 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

A Cross-site scripting (XSS) vulnerability was found in the Unified Alerting feature of Grafana. This stored XSS can elevate privileges from Editor to Admin.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Fixed: 3 products Known not affected: 15 products

https://access.redhat.com/errata/RHSA-2023:3642

Open the full advisory

RHSA-2023_3642

Vulnerability from csaf_redhat - Published: 2023-06-15 15:59 - Updated: 2024-12-17 22:21

Summary

Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update

Severity

Important

Scope

35 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

A Cross-site scripting (XSS) vulnerability was found in the Unified Alerting feature of Grafana. This stored XSS can elevate privileges from Editor to Admin.

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Fixed: 3 products Known not affected: 15 products

https://access.redhat.com/errata/RHSA-2023:3642

Open the full advisory

SUSE-SU-2022:3676-1

Vulnerability from csaf_suse - Published: 2022-10-20 11:40 - Updated: 2022-10-20 11:40

Summary

Security update for grafana

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 2 products

Open the full advisory

SUSE-SU-2022:3747-1

Vulnerability from csaf_suse - Published: 2022-10-26 08:40 - Updated: 2022-10-26 08:40

Summary

Security update for SUSE Manager Client Tools

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 46 products

Open the full advisory

SUSE-SU-2022:3751-1

Vulnerability from csaf_suse - Published: 2022-10-26 08:48 - Updated: 2022-10-26 08:48

Summary

Security update for SUSE Manager Client Tools

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 59 products

Open the full advisory

SUSE-SU-2022:3765-1

Vulnerability from csaf_suse - Published: 2022-10-26 09:17 - Updated: 2022-10-26 09:17

Summary

Security update for grafana

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 12 products

Open the full advisory

SUSE-SU-2022:4428-1

Vulnerability from csaf_suse - Published: 2022-12-13 07:29 - Updated: 2022-12-13 07:29

Summary

Security update for grafana

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 12 products

Open the full advisory

SUSE-SU-2022:4437-1

Vulnerability from csaf_suse - Published: 2022-12-13 07:33 - Updated: 2022-12-13 07:33

Summary

Security update for SUSE Manager Client Tools

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2022-31097.

CVE-2022-31097

7.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Recommended: 70 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-31097 (GCVE-0-2022-31097)

OESA-2025-1189 (CVE-2022-31097)

Tags

Sightings

Nomenclature

Related by attack behaviour