CVE-2022-39324

Grafana is an open-source platform for monitoring and observability. Prior
to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and
arbitrarily choose the originalUrl parameter by editing the query, thanks
to a web proxy. When another user opens the URL of the snapshot, they will
be presented with the regular web interface delivered by the trusted
Grafana server. The Open original dashboard button no longer points to
the to the real original dashboard but to the attacker’s injected URL. This
issue is fixed in versions 8.5.16 and 9.2.8.

Notes