The vulnerability of the Grafana monitoring and observation platform lies in improper verification of the cryptographic signature. This allows a malicious actor to install malware on a vulnerable device.

The vulnerability of the Grafana monitoring and observation platform relates to bypassing the plugin signature verification process. Exploiting this vulnerability allows a malicious actor to install malware on a vulnerable device remotely...

CVE-2022-31123

Grafana contains a plugin-signature verification bypass (CVE-2022-31123) due to a versioning flaw in signed/unsigned plugin handling. A local authenticated attacker could persuade a server admin to load a malicious unsigned plugin. Affected CTs: Grafana versions prior to 9.1.8 and 8.5.14. Remedia...

CVE-2022-31123: Improper Verification of Cryptographic Signature

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are...