CVE-2022-31097 Stored XSS in Grafana's Unified Alerting

2022-07-1512:10:10

CWE-79

GitHub_M

www.cve.org

grafana

vulnerability

stored xss

unified alerting

privilege escalation

admin

patch

workaround

disable alerting

legacy alerting

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

7.8

Confidence

High

EPSS

0.006

Percentile

77.6%

JSON

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

CNA Affected

[
  {
    "product": "grafana",
    "vendor": "grafana",
    "versions": [
      {
        "status": "affected",
        "version": ">= 9.0.0, < 9.0.3"
      },
      {
        "status": "affected",
        "version": ">= 8.5.0, < 8.5.9"
      },
      {
        "status": "affected",
        "version": ">= 8.4.0, < 8.4.10"
      },
      {
        "status": "affected",
        "version": ">= 8.0.0, < 8.3.10"
      }
    ]
  }
]