CVE-2022-21703: Cross Site Request Forgery in Grafana
Vulnerability summary
CVE-2022-21703 is a high (CVSS 8.8) Cross-Site Request Forgery vulnerability in fedoraproject fedora. EPSS estimates a 2.28% chance of exploitation in the next 30 days, higher than 83.1% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 08-02-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.28%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.28% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- grafana≥ 3.0.1, < 8.3.6-r0
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Github.com/grafana/grafana/pkg1 product
- web≥ 3.0-beta1, < 7.5.15 | ≥ 8.0.0, < 8.3.5
Grafana1 product
- grafana≥ 3.0-beta1, < 7.5.15 | ≥ 3.0.1, < 7.5.15 | ≥ 8.0.0, < 8.3.5 | 3.0.0:beta1 | 3.0.0:beta2 | 3.0.0:beta3 | 3.0.0:beta4 | 3.0.0:beta5 | 3.0.0:beta6 | 3.0.0:beta7
Netapp1 product
Ubuntu1 product
- grafanaAll versions (No fix recorded)
6 vendors · 6 products
References
16 links- grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/X Refsource MISCMitigationRelease NotesVendor Advisory
- github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8wX Refsource CONFIRMWEBMitigationRelease NotesThird Party Advisory
