{"id":"CVE-2022-39324","published":"2023-01-27T22:42:01Z","modified":"2026-01-28T04:55:22Z","title":"Grafana vulnerable to spoofing originalUrl of snapshots","vendor":"grafana","product":"grafana","tier":"tail","description":{"text":"Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00828,"percentile":0.57473,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-4724-7jwc-3fpw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/grafana/grafana/pull/60232","tags":["x_refsource_MISC"]},{"url":"https://github.com/grafana/grafana/pull/60256","tags":["x_refsource_MISC"]},{"url":"https://github.com/grafana/grafana/commit/239888f22983010576bb3a9135a7294e88c0c74a","tags":["x_refsource_MISC"]},{"url":"https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20230309-0010/","tags":[]}],"priority":{"score":16.2,"factors":[{"name":"EPSS percentile","points":11.49},{"name":"CVSS severity","points":4.69}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"grafana","product":"grafana","versions":["< 8.5.16",">= 9.0.0, < 9.2.8"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=9.0.0, <9.2.8","<8.5.16","all versions"],"patched":["9.2.8","8.5.16"],"from":["GHSA-4724-7jwc-3fpw","GO-2024-2867"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1406","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-grafana-cve-2021-39226","parents":[{"from":"CVE-2021-39226","to":"CVE-2022-39324","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["pkg/api/dashboard_snapshot.go"],"commits":["https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269","https://github.com/grafana/grafana/commit/239888f22983010576bb3a9135a7294e88c0c74a","https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c"],"basis":"shared function","functions":["CreateDashboardSnapshot"]}]}],"packageHistory":[{"cve":"CVE-2022-39306","published":"2022-11-09","fixed":"9.2.4","kev":false},{"cve":"CVE-2022-39307","published":"2022-11-09","fixed":"9.2.4","kev":false,"link":{"from":"CVE-2022-39307","to":"CVE-2022-39324","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.5.15","toFixed":"8.5.16","daysApart":79},{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"9.2.4","toFixed":"9.2.8","daysApart":79}]}},{"cve":"CVE-2022-39328","published":"2022-11-08","fixed":"9.2.4","kev":false},{"cve":"CVE-2022-39324","published":"2023-01-27","fixed":"9.2.8","kev":false},{"cve":"CVE-2023-22462","published":"2023-03-02","fixed":"9.3.4","kev":false,"link":{"from":"CVE-2022-39324","to":"CVE-2023-22462","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"9.2.8","toFixed":"9.2.10","daysApart":34}]}},{"cve":"CVE-2023-0507","published":"2023-03-01","fixed":"9.3.8","kev":false,"link":{"from":"CVE-2022-39324","to":"CVE-2023-0507","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.5.16","toFixed":"8.5.21","daysApart":33}]}},{"cve":"CVE-2023-0594","published":"2023-03-01","fixed":"9.3.8","kev":false,"link":{"from":"CVE-2022-39324","to":"CVE-2023-0594","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.5.16","toFixed":"8.5.21","daysApart":33}]}}],"package":"Go:github.com/grafana/grafana"}}