CVE-2022-39324

Aliases:GHSA-4724-7jwc-3fpwBIT-grafana-2022-39324GO-2024-2867
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 27 Jan 2023, 22:42
Last modified:28 Jan 2026, 04:55

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.7 MEDIUM
v3.1 (cve.org)
EPSS Score
0.18% LOW
0% probability +0.08%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jan 2023, 22:42
Published
Vulnerability first disclosed
28 Jan 2026, 04:55
Last Modified
Vulnerability information updated

Description

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

CVSS Metrics

  • v4.0•MEDIUM•Score: 5.3CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
  • v3.1•MEDIUM•Score: 6.7CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
  • v3.1•LOW•Score: 3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.18%• Percentile: 40%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • github.com/grafana•grafana

    ≥ 9.0.0, < 9.2.8 | < 8.5.16 | all

  • grafana•grafana

    < 8.5.16 | ≥ 9.0.0, < 9.2.8

References (8)