Lucene search
Redhat.comRH:CVE-2022-39324HistoryJan 30, 2023 - 1:05 p.m.
CVE-2022-39324
2023-01-3013:05:33
redhat.com
access.redhat.com
36
cve-2022-39324
grafana package
snapshot creation
malicious url injection
http parameter
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.006
Percentile
78.1%
A flaw was found in the grafana package. While creating a snapshot, an attacker may manipulate a hidden HTTP parameter to inject a malicious URL in the “Open original dashboard” button.
Related
freebsd
freebsd
Grafana -- Stored XSS in ResourcePicker component
2022-12-16 00:00:00
Grafana -- Spoofing originalUrl of snapshots
2023-01-25 00:00:00
redhatcve
redhatcve
CVE-2022-23552
2023-01-30 13:35:45
CVE-2022-41912
2022-11-29 06:26:34
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2023:0812-1)
2023-03-28 00:00:00
osv
osv
grafana-8.5.20-1.1 on GA media
2024-06-15 00:00:00
BIT-grafana-2022-23552
2024-03-06 10:57:42
CVE-2022-39324
2023-01-27 23:15:08
nessus
nessus
nvd
nvd
github
github
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
2022-11-29 23:55:54
Grafana Spoofing originalUrl of snapshots
2024-05-14 22:29:26
veracode
veracode
Authentication Bypass
2022-11-22 05:45:33
Cross Site Scripting (XSS)
2023-02-02 11:20:58
Stored XSS
2023-07-26 11:27:01
ubuntucve
ubuntucve
cve
cve
debiancve
debiancve
CVE-2022-41912
2022-11-28 15:15:10
prion
prion
Open redirect
2023-01-27 23:15:00
Cross site scripting
2023-01-27 23:15:00
Authentication flaw
2022-11-28 15:15:00
cvelist
cvelist
vulnrichment
vulnrichment
CVE-2022-39324 Grafana vulnerable to spoofing originalUrl of snapshots
2023-01-27 22:42:01
CVE-2022-23552 Grafana stored XSS in FileUploader component
2023-01-27 22:59:16
cgr
cgr
CVE-2022-39324 vulnerabilities
2024-05-19 03:07:16
ibm
ibm
redhat
redhat
almalinux
almalinux
Moderate: grafana security and enhancement update
2023-11-07 00:00:00
oraclelinux
oraclelinux
grafana security and enhancement update
2023-11-11 00:00:00
redos
redos
ROS-20240404-01
2024-04-04 00:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.006
Percentile
78.1%
Related for RH:CVE-2022-39324