Patchfirst
Patchfirst
CVE-2022-31097 High · 7.3 EPSS 70.1%

Stored XSS in Grafana's Unified Alerting

grafana · grafana

Summary

A stored cross-site scripting flaw in the Unified Alerting feature of Grafana, the open-source monitoring and observability platform, affects its 8.x and 9.x releases before the patched versions. An authenticated user with editor rights can exploit it, with user interaction required: by getting an authenticated administrator to click a link, the attacker can escalate their privileges from editor to admin.

Official description · CVE.org

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Breakdown
25.0 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 15 Jul 2022. No public exploit code or confirmed exploitation is recorded.

7 fixes in github.com/grafana/grafana over 9 months. The latest fix listed for github.com/grafana/grafana is 9.1.6.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 8.3.2CVE-2021-4381510 Dec 2021
  2. 8.3.5CVE-2022-217028 Feb 2022
  3. 8.3.5CVE-2022-217138 Feb 2022
  4. 9.0.3CVE-2022-3109715 Jul 2022
  5. 9.0.3CVE-2022-3110715 Jul 2022
  6. 9.1.6CVE-2022-3595720 Sep 2022
  7. 9.1.6CVE-2022-3606222 Sep 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-vw7q-p2qg-4m5fGO-2024-2857

Upgrade to 9.0.3

Still affected on this line by CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

Also affected, despite being newer: All versions.

Gogo get github.com/grafana/grafana@v9.0.3

The first fix for CVE-2022-31097.

Affected versions, by release line

If you runUpgrade to
9.0.0 up to 9.0.39.0.3
8.5.0 up to 8.5.9

Still affected on this line by CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

8.5.9
8.4.0 up to 8.4.10

Still affected on this line by CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

8.4.10
8.0.0 up to 8.3.10

Still affected on this line by CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

8.3.10
All versionsNo fix published

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

5 links, grouped by NVD tag

x_refsource_CONFIRM 2

github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5fsecurity.netapp.com/advisory/ntap-20220901-0010/

x_refsource_MISC 3

grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/
↑ ↓ chooseEnter openEsc close