Vulnetix
Try Vulnetix Request Demo
CVE-2022-31097 PUBLISHED

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

EPSS 48.06% · 97.7th percentile

Risk Scores

EPSS Score
48.06%
97.7th percentile

Affected Products

VendorProductVersions
Bitnamigrafana9.0.0, 8.0.0, 8.4.0
Bitnamigrafana8.0.0, 8.4.0, 8.5.0

Timeline

References

Open in Interactive Console →