CVE-2022-31130

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada grafana. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.

Rincian

Terbit di NVD

13 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grafana/grafana/commit/4dd56e4dabce10007bf4ba1059bf54178c35b177 patch · advisory pihak ketiga
• https://github.com/grafana/grafana/commit/9da278c044ba605eb5a1886c48df9a2cb0d3885f patch · advisory pihak ketiga
• https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc patch · advisory pihak ketiga
• https://github.com/grafana/grafana/releases/tag/v9.1.8 release notes · advisory pihak ketiga