VDB
CVE-2022-31130
CVE-2022-31130
PUBLISHED
Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.
EPSS 0.38% · 59.7th percentile
Risk Scores
EPSS Score
0.38%
59.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 9.0.0, 0 |
| Bitnami | grafana | 9.0.0, 0 |
Timeline
- Oct 12, 2022 CVE Published
- Oct 14, 2022 EPSS Score
- Nov 27, 2022 EPSS Score
- Jan 10, 2023 EPSS Score
- Feb 23, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- May 22, 2023 EPSS Score
- Jul 5, 2023 EPSS Score
- Aug 18, 2023 EPSS Score
- Sep 30, 2023 EPSS Score
- Nov 13, 2023 EPSS Score
References
- https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177 url
- https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f url
- https://github.com/grafana/grafana/releases/tag/v9.1.8 url
- https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc url
- https://nvd.nist.gov/vuln/detail/CVE-2022-31130 url