CVE-2022-39324

CVSS V2 None CVSS V3 None
Description
Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.
Overview
  • CVE ID
  • CVE-2022-39324
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-27T23:15:08
  • Last Modified Date
  • 2023-02-07T20:17:46
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* 1 OR 8.5.16
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* 1 OR 9.0.0 9.2.8
History
Created Old Value New Value Data Type Notes
2023-04-17 06:53:56 Added to TrackCVE
2023-04-17 06:53:58 Weakness Enumeration new