CVE-2022-31097

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-31097
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31097.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-31097
Aliases
Downstream
Related
Published
2022-07-15T12:10:10Z
Modified
2025-10-30T19:32:23Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Stored XSS in Grafana's Unified Alerting
Details

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
b5c56f63710e09f37b8557ddd8b99ae3fc583169
Fixed
023f9251a91743d2399fc32dcf5df8422759a8eb
Database specific 
{
    "versions": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
6134e3cf35a99c7dd3041b7ececb47cb7619ba9a
Fixed
2955d0bc8acaa69edbc03c3efb5c1e4f1e9d84d9
Database specific 
{
    "versions": [
        {
            "introduced": "8.5.0"
        },
        {
            "fixed": "8.5.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
e6728d143480cc05d6f91eb740f91836399b8e6a
Fixed
0f5a1e53f03a0735e013e4f3fb7ec084865ef964
Database specific 
{
    "versions": [
        {
            "introduced": "8.4.0"
        },
        {
            "fixed": "8.4.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
41f0542c1ec16ce93b336a9f5cf6eef1aba898d0
Fixed
1cf8d3e67c07450a04fe0a8513e6fbe21ae89ca6
Database specific 
{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.3.10"
        }
    ]
}