VDB
CVE-2022-31130
CVE-2022-31130
PUBLISHED
CVSS 7.5 HIGH
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
EPSS 1.33% · 70.7th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
1.33%
70.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 9.0.0, 0 |
| Bitnami | grafana | 9.0.0, 0 |
Timeline
- Oct 12, 2022 CVE Published
- Oct 14, 2022 EPSS Score
- Nov 28, 2022 EPSS Score
- Jan 11, 2023 EPSS Score
- Feb 25, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 11, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 9, 2023 EPSS Score
- Oct 6, 2023 EPSS Score
- Nov 20, 2023 EPSS Score
- Jan 4, 2024 EPSS Score
References
- https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177 url
- https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f url
- https://github.com/grafana/grafana/releases/tag/v9.1.8 url
- https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc url
- https://nvd.nist.gov/vuln/detail/CVE-2022-31130 url