{"schemaVersion":3,"id":"CVE-2022-31107","aliases":["RHSA-2022:5716","RHSA-2022:5717","RHSA-2022:5718","RHSA-2022:5719","RHSA-2022:5720","UBUNTU-CVE-2022-31107","GHSA-mx47-6497-3fv2","BIT-grafana-2022-31107","GO-2024-2852","CGA-23w2-66p9-9hjr","CGA-2w9v-64h7-9wf5","CGA-3h36-v8fq-pmg8","CGA-3pv4-p6g2-jf4g","CGA-3rvq-cpcp-3qc3","CGA-47x8-xgwp-pcqq","CGA-49r2-g3hw-7xmh","CGA-4vfm-q6ch-fhq3","CGA-5h4g-8p82-jw46","CGA-62jw-2995-9p86","CGA-67m9-r4gc-px5x","CGA-6jh6-42fq-gq6x","CGA-6rw7-5j3j-8rcp","CGA-72m9-g9wq-8jvj","CGA-75m3-q3ph-gx7x","CGA-7c42-fmqc-7mw8","CGA-854m-xwwc-993r","CGA-94x2-5fwg-9m74","CGA-95cx-6cgh-m267","CGA-9mpq-g8gr-jr3m","CGA-9vgg-9q3v-h487","CGA-c9f7-fgmq-9xxq","CGA-hhfj-mx25-cfr3","CGA-j3v2-4mjf-x946","CGA-j4m9-4mq6-q67x","CGA-m7c7-3w85-7vwv","CGA-mcm5-q4qp-3wm8","CGA-mg44-2m3p-xc9h","CGA-r34p-jqwr-3636","CGA-r732-x4r5-c9pq","CGA-v7jp-vfv9-98wr","CGA-vg9r-qp55-wx7p","CGA-vgrg-hx9c-9jvm","CGA-vj5h-hh4j-6vfv","CGA-vm2w-9hm2-fpjg","CGA-vmhg-rrq2-rq6p","CGA-wh7h-996f-rm77","CGA-x25m-6m4v-c6p3","CGA-x56c-jq2j-9h9v","CGA-xmhf-xr94-xm2p"],"status":"published","duplicateOf":null,"title":null,"description":"Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.","dates":{"published":"2022-07-15T12:30:14.000Z","modified":"2026-01-28T04:55:31.786Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Red hat","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","exploitability":4.1,"impact":9.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.1,"impact":9.8,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":7.6,"severity":"high","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","exploitability":4.1,"impact":9.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","exploitability":4.1,"impact":9.2,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02874,"percentile":0.86604,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.15800000000000014,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02716},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02874,"percentile":0.86604}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02716,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02874,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02874,"percentile":0.86604}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"chainguard","product":"grafana-fips-11.6","name":"grafana-fips-11.6","label":"grafana-fips-11.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-11.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.0","name":"grafana-fips-12.0","label":"grafana-fips-12.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.0","purlType":"apk","versions":[{"text":"< 12.0.10-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.0.10-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.1","name":"grafana-fips-12.1","label":"grafana-fips-12.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.1","purlType":"apk","versions":[{"text":"< 12.1.10.01-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.1.10.01-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.2","name":"grafana-fips-12.2","label":"grafana-fips-12.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.3","name":"grafana-fips-12.3","label":"grafana-fips-12.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-12.4","name":"grafana-fips-12.4","label":"grafana-fips-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-12.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.0","name":"grafana-fips-13.0","label":"grafana-fips-13.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"grafana-fips-13.1","name":"grafana-fips-13.1","label":"grafana-fips-13.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/grafana-fips-13.1","purlType":"apk","versions":[{"text":"< 13.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.1.0-r0","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"grafana","name":"grafana","label":"grafana","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/grafana","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/grafana","product":"grafana","name":"github.com/grafana/grafana","label":"grafana","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/grafana/grafana","purlType":"golang","versions":[{"text":"≥ 5.3.0-beta1, < 8.3.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.0, < 8.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.3","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"≥ 5.3.0-beta1, < 8.3.10 | ≥ 8.4.0, < 8.4.10 | ≥ 8.5.0, < 8.5.9 | ≥ 9.0.0, < 9.0.3 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"grafana","product":"grafana","name":"grafana","label":"grafana","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.3, < 8.3.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, < 8.3.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.10","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.0, < 8.5.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.0.0, < 9.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.3, < 8.3.10 | ≥ 5.3.0, < 8.3.10 | ≥ 8.4.0, < 8.4.10 | ≥ 8.5.0, < 8.5.9 | ≥ 9.0.0, < 9.0.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"grafana","label":"Grafana","category":"server-app"}},"hubHref":"/vendor/grafana/grafana"},{"vendor":"netapp","product":"e-series_performance_analyzer","name":"e-series performance analyzer","label":"e-series_performance_analyzer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/netapp/e-series_performance_analyzer"},{"vendor":"redhat","product":"grafana","name":"grafana","label":"grafana","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana","purlType":"rpm","versions":[{"text":"< 0:7.5.11-5.el9_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-3.el8_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.3.6-5.el8_4","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:7.5.11-5.el9_0 | < 0:7.5.11-3.el8_6 | < 0:7.3.6-5.el8_4 | < 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-azure-monitor","name":"grafana-azure-monitor","label":"grafana-azure-monitor","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-azure-monitor","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-cloudwatch","name":"grafana-cloudwatch","label":"grafana-cloudwatch","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-cloudwatch","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-debuginfo","name":"grafana-debuginfo","label":"grafana-debuginfo","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-debuginfo","purlType":"rpm","versions":[{"text":"< 0:7.5.11-5.el9_0","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.5.11-3.el8_6","noFixRecorded":false,"fixedIn":null},{"text":"< 0:7.3.6-5.el8_4","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:7.5.11-5.el9_0 | < 0:7.5.11-3.el8_6 | < 0:7.3.6-5.el8_4 | < 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-elasticsearch","name":"grafana-elasticsearch","label":"grafana-elasticsearch","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-elasticsearch","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-graphite","name":"grafana-graphite","label":"grafana-graphite","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-graphite","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-influxdb","name":"grafana-influxdb","label":"grafana-influxdb","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-influxdb","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-loki","name":"grafana-loki","label":"grafana-loki","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-loki","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-mssql","name":"grafana-mssql","label":"grafana-mssql","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-mssql","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-mysql","name":"grafana-mysql","label":"grafana-mysql","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-mysql","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-opentsdb","name":"grafana-opentsdb","label":"grafana-opentsdb","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-opentsdb","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-postgres","name":"grafana-postgres","label":"grafana-postgres","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-postgres","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-prometheus","name":"grafana-prometheus","label":"grafana-prometheus","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-prometheus","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null},{"vendor":"redhat","product":"grafana-stackdriver","name":"grafana-stackdriver","label":"grafana-stackdriver","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/grafana-stackdriver","purlType":"rpm","versions":[{"text":"< 0:6.3.6-5.el8_2","noFixRecorded":false,"fixedIn":null},{"text":"< 0:6.2.2-9.el8_1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1","eol":null,"hubHref":null}],"affectedCount":26,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/","label":"grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/","hostname":"grafana.com","tags":["X Refsource MISC","WEB","Release Notes","Vendor Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2","label":"github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2","hostname":"github.com","tags":["X Refsource CONFIRM","ARTICLE","WEB","Advisory","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/","label":"grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/","hostname":"grafana.com","tags":["X Refsource MISC","WEB","Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/","label":"grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/","hostname":"grafana.com","tags":["X Refsource MISC","WEB","Release Notes","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220901-0010/","label":"security.netapp.com/advisory/ntap-20220901-0010/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Advisory","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5716","label":"access.redhat.com/errata/RHSA-2022:5716","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104367","label":"bugzilla.redhat.com/show_bug.cgi?id=2104367","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5716.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5716.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31107","label":"access.redhat.com/security/cve/CVE-2022-31107","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31107","label":"www.cve.org/CVERecord?id=CVE-2022-31107","hostname":"www.cve.org","tags":["Advisory","REPORT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31107","label":"nvd.nist.gov/vuln/detail/CVE-2022-31107","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5717","label":"access.redhat.com/errata/RHSA-2022:5717","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5717.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5717.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5718","label":"access.redhat.com/errata/RHSA-2022:5718","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5718.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5718.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5719","label":"access.redhat.com/errata/RHSA-2022:5719","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5719.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5719.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5720","label":"access.redhat.com/errata/RHSA-2022:5720","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5720.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5720.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-31107","label":"ubuntu.com/security/CVE-2022-31107","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://github.com/grafana/grafana","label":"github.com/grafana/grafana","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10","label":"grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10","hostname":"grafana.com","tags":["WEB"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9","label":"grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9","hostname":"grafana.com","tags":["WEB"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3","label":"grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3","hostname":"grafana.com","tags":["WEB"]},{"url":"https://security.netapp.com/advisory/ntap-20220901-0010","label":"security.netapp.com/advisory/ntap-20220901-0010","hostname":"security.netapp.com","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31107.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31107.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:12260-1","SUSE-SU-2022:3676-1","SUSE-SU-2022:3747-1","SUSE-SU-2022:3751-1","SUSE-SU-2022:3765-1","SUSE-SU-2022:4428-1","SUSE-SU-2022:4437-1","SUSE-SU-2022:4439-1","SUSE-SU-2023:2575-1","SUSE-SU-2023:2578-1","SUSE-SU-2023:2579-1","SUSE-SU-2024:0191-1","SUSE-SU-2024:0196-1"],"duplicates":[],"related":["CGA-2FMM-8PXW-6XMW","CGA-3MGC-JRH8-2RMQ","OPENSUSE-SU-2024:12260-1","SUSE-SU-2022:3676-1","SUSE-SU-2022:3747-1","SUSE-SU-2022:3751-1","SUSE-SU-2022:3765-1","SUSE-SU-2022:4428-1","SUSE-SU-2022:4437-1","SUSE-SU-2022:4439-1","SUSE-SU-2023:2575-1","SUSE-SU-2023:2578-1","SUSE-SU-2023:2579-1","SUSE-SU-2024:0191-1","SUSE-SU-2024:0196-1"]},"timeline":[{"kind":"published","date":"2022-07-15T12:30:14.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-01-28T04:55:31.786Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T12:09:47.166Z","stale":false,"partial":false}}