{"resultsPerPage":10,"startIndex":0,"totalResults":45,"format":"NVD_CVE","version":"2.0","timestamp":"2026-07-21T02:11:03.864","vulnerabilities":[{"cve":{"id":"CVE-2021-41174","sourceIdentifier":"security-advisories@github.com","published":"2021-11-03T18:15:08.413","lastModified":"2026-06-17T04:08:01.500","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. En las versiones afectadas, si un atacante es capaz de convencer a una víctima de que visite una URL que haga referencia a una página vulnerable, se puede ejecutar contenido JavaScript arbitrario en el contexto del navegador de la víctima. El usuario que visita el enlace malicioso debe no estar autenticado y el enlace debe ser para una página que contenga el botón de inicio de sesión en la barra de menú. La url tiene que estar diseñada para explotar el renderizado de AngularJS y contener el enlace de interpolación para las expresiones de AngularJS. AngularJS utiliza llaves dobles para la interpolación: {{ }} ej: {{constructor.constructor('alert(1)')()}}. Cuando el usuario sigue el enlace y la página se renderiza, el botón de inicio de sesión contendrá el enlace original con un parámetro de consulta para forzar una redirección a la página de inicio de sesión. La URL no se valida y el motor de renderizado de AngularJS ejecutará la expresión JavaScript contenida en la URL. Se recomienda a los usuarios que actualicen lo antes posible. Si por alguna razón no pueden actualizar, pueden utilizar un proxy inverso o similar para bloquear el acceso a la cadena literal {{ en la ruta"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 8.0.0, < 8.2.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.2.3","matchCriteriaId":"A9B9C101-2003-4213-9B6D-B92CDD6C3370"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/fb85ed691290d211a5baa44d9a641ab137f0de88","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211125-0003/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/fb85ed691290d211a5baa44d9a641ab137f0de88","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211125-0003/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-41244","sourceIdentifier":"security-advisories@github.com","published":"2021-11-15T20:15:19.970","lastModified":"2026-06-17T04:08:09.823","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. En las versiones afectadas, cuando la función beta de control de acceso de grano fino está habilitada y presenta más de una organización en la instancia de Grafana, los administradores pueden acceder a usuarios de otras organizaciones. Grafana versión 8.0 introdujo un mecanismo que permitía a usuarios con el rol de administrador de la organización listar, añadir, eliminar y actualizar los roles de los usuarios en otras organizaciones en las que no son administradores. Con el control de acceso de grano fino habilitado, los administradores de la organización pueden listar, añadir, eliminar y actualizar los roles de los usuarios en otra organización, donde no tienen el rol de administrador de la organización. Todas las instalaciones entre la v8.0 y la v8.2.3 que tengan habilitado el control de acceso detallado beta y más de una organización deben actualizarse lo antes posible. Si no es posible actualizar, es debido deshabilitar el control de acceso de grano fino usando un flag de función"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 8.0.0, < 8.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-610"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.2.4","matchCriteriaId":"42E1A891-6ECB-4E41-8978-25CFAE582244"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/11/15/1","source":"security-advisories@github.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211223-0001/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/11/15/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211223-0001/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-43798","sourceIdentifier":"security-advisories@github.com","published":"2021-12-07T19:15:07.633","lastModified":"2026-06-17T04:11:27.540","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observación. Grafana versiones 8.0.0-beta1 hasta 8.3.0 (excepto las versiones parcheadas) son vulnerables a un salto de directorio, permitiendo el acceso a archivos locales. La ruta de la URL vulnerable es: \"(grafana_host_url)/public/plugins//\", donde está el ID del plugin para cualquier plugin instalado. En ningún momento Grafana Cloud ha sido vulnerable. Se aconseja a usuarios que actualicen a las versiones parcheadas 8.0.7, 8.1.8, 8.2.7 o 8.3.1. El aviso de seguridad de GitHub contiene más información sobre las rutas de URL vulnerables, la mitigación y el calendario de divulgación"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 8.0.0, < 8.0.7","status":"affected"},{"version":">= 8.1.0, < 8.1.8","status":"affected"},{"version":">= 8.2.0, < 8.2.7","status":"affected"},{"version":"= 8.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-09T03:55:40.438037Z","id":"CVE-2021-43798","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2025-10-09","cisaActionDue":"2025-10-30","cisaRequiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Grafana Path Traversal Vulnerability","weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.1","versionEndExcluding":"8.0.7","matchCriteriaId":"449504C1-1B9B-4D4E-940B-7107D6235AF3"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.1.0","versionEndExcluding":"8.1.8","matchCriteriaId":"53D52B8C-3355-4329-B222-4C3878A8F074"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.7","matchCriteriaId":"860C7085-A83F-4A15-8587-6A4A598D9141"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:8.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"0D8F31CD-1C2B-47F0-9629-D29AD700F689"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:8.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"CA972DB1-60A8-470F-86F5-A7AFB1C98666"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:8.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"4FF3AB6B-AAE8-41DF-BB0A-3FE119E826D1"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:8.3.0:*:*:*:*:*:*:*","matchCriteriaId":"DB249517-1BC4-4D6F-8C8F-D1744CFF4E4C"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html","source":"security-advisories@github.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/09/2","source":"security-advisories@github.com","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"security-advisories@github.com","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]},{"url":"https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211229-0004/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/09/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20211229-0004/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2021-43813","sourceIdentifier":"security-advisories@github.com","published":"2021-12-10T18:15:08.260","lastModified":"2026-06-17T04:11:29.440","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Grafana versiones anteriores a 8.3.2 y 7.5.12, contiene una vulnerabilidad de salto de directorio para archivos .md completamente en minúsculas o en mayúsculas. La vulnerabilidad presenta un alcance limitado y sólo permite el acceso a los archivos con la extensión .md a usuarios autentificados. Las instancias de Grafana Cloud no han sido afectadas por la vulnerabilidad. Los usuarios deben actualizar a las versiones parcheadas 8.3.2 o 7.5.12. Para usuarios que no puedan actualizar, la ejecución de un proxy inverso frente a Grafana que normalice el PATH de la petición mitigará la vulnerabilidad. El proxy también tendrá que ser capaz de manejar rutas codificadas con url. Alternativamente, para archivos .md completamente en minúsculas o en mayúsculas, los usuarios pueden bloquear /api/plugins/.*/markdown/.* sin perder ninguna funcionalidad más allá del texto de ayuda del plugin alineado"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 5.0.0, < 7.5.12","status":"affected"},{"version":">= 8.0.0, < 8.3.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"7.5.12","matchCriteriaId":"C8A7F175-5768-4685-A192-25B4D97FF0CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.2","matchCriteriaId":"072437F7-4A16-4373-9026-7C20B0D2AFB8"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"security-advisories@github.com","tags":["Mailing List","Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0f","source":"security-advisories@github.com","tags":["Broken Link"]},{"url":"https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q","source":"security-advisories@github.com","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/","source":"security-advisories@github.com","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-12/","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-2/","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220107-0006/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-12/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-2/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220107-0006/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-43815","sourceIdentifier":"security-advisories@github.com","published":"2021-12-10T21:15:09.497","lastModified":"2026-06-17T04:11:29.713","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Grafana versiones anteriores a 8.3.2 y 7.5.12, presenta un salto de directorios para archivos .csv arbitrarios. Sólo afecta a las instancias que tienen habilitada y configurada la herramienta de pruebas para desarrolladores llamada fuente de datos TestData DB. La vulnerabilidad presenta un alcance limitado y sólo permite el acceso a los archivos con la extensión .csv a usuarios autenticados. Las instancias de Grafana Cloud no se han visto afectadas por la vulnerabilidad. Las versiones 8.3.2 y 7.5.12 contienen un parche para este problema. Se presenta una solución disponible para usuarios que no pueden actualizar. Ejecutar un proxy inverso frente a Grafana que normalice el PATH de la petición mitigará la vulnerabilidad. El proxy también tendrá que ser capaz de manejar rutas codificadas con url"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 8.0.0-beta3, < 8.3.2","status":"affected"},{"version":">= 5.0.0, < 7.5.12","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:N/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionEndExcluding":"7.5.12","matchCriteriaId":"9E8AA544-0EAE-40C6-8C0E-E1276C1A2D32"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.2","matchCriteriaId":"072437F7-4A16-4373-9026-7C20B0D2AFB8"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"security-advisories@github.com","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/releases/tag/v8.3.2","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220107-0006/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/10/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/releases/tag/v8.3.2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220107-0006/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-21673","sourceIdentifier":"security-advisories@github.com","published":"2022-01-18T22:15:07.873","lastModified":"2026-06-17T04:26:44.100","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the OAuth Identity of the most recently logged-in user. This can allow API token holders to retrieve data for which they may not have intended access. This attack relies on the Grafana instance having data sources that support the Forward OAuth Identity feature, the Grafana instance having a data source with the Forward OAuth Identity feature toggled on, the Grafana instance having OAuth enabled, and the Grafana instance having usable API keys. This issue has been patched in versions 7.5.13 and 8.3.4."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. En las versiones afectadas, cuando una fuente de datos tiene habilitada la funcionalidad Forward OAuth Identity, el envío de una consulta a esa fuente de datos con un token de API (y sin otras credenciales de usuario) reenviará la OAuth Identity del usuario que haya iniciado sesión más recientemente. Esto puede permitir a poseedores de tokens de API recuperar datos a los que no presentan acceso previsto. Este ataque depende de que la instancia de Grafana tenga fuentes de datos que soporten la funcionalidad Forward OAuth Identity, de que la instancia de Grafana tenga una fuente de datos con la función Forward OAuth Identity activada, de que la instancia de Grafana tenga OAuth habilitado y de que la instancia de Grafana tenga claves de API usables. Este problema ha sido corregido en las versiones 7.5.13 y 8.3.4"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 7.2.0, < 7.5.13","status":"affected"},{"version":">= 8.0.0, < 8.3.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:N/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T14:12:04.035353Z","id":"CVE-2022-21673","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2.0","versionEndExcluding":"7.5.13","matchCriteriaId":"DB832562-836C-4E18-8086-1260790CD2EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.4","matchCriteriaId":"4FE88214-73A3-43A6-9858-F8CDE027D1FA"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/releases/tag/v7.5.13","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/releases/tag/v8.3.4","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0004/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/releases/tag/v7.5.13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/releases/tag/v8.3.4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-8wjh-59cw-9xh4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0004/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-21702","sourceIdentifier":"security-advisories@github.com","published":"2022-02-08T20:15:08.987","lastModified":"2026-06-17T04:26:47.850","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. En las versiones afectadas, un atacante podría servir contenido HTML mediante la fuente de datos de Grafana o el proxy del plugin y engañar a un usuario para que visite esta página HTML usando un enlace especialmente diseñado y ejecutar un ataque de tipo Cross-site Scripting (XSS). El atacante podría comprometer una fuente de datos existente para una instancia específica de Grafana o bien configurar su propio servicio público e instruir a cualquiera para que lo configure en su instancia de Grafana. Para ser impactado, todo lo siguiente debe ser aplicable. Para el proxy de la fuente de datos: Una fuente de datos basada en HTTP de Grafana configurada con Servidor como Modo de Acceso y una URL establecida, el atacante debe estar en control del servidor HTTP que sirve la URL de dicha fuente de datos, y un enlace especialmente diseñado que apunte a la fuente de datos controlada por el atacante debe ser pulsado por un usuario autenticado. Para el plugin proxy: Un plugin de Grafana basado en HTTP configurado y habilitado con un conjunto de URL, el atacante debe estar en control del servidor HTTP que sirve la URL de la aplicación anterior, y un enlace especialmente diseñado que apunte al plugin controlado por el atacante debe ser marcado por un usuario autenticado. Para el recurso del plugin backend: Un atacante debe ser capaz de dirigir a un usuario autenticado a un plugin comprometido mediante un enlace diseñado. Es recomendado a usuarios actualizar a una versión parcheada. No hay medidas de mitigación adicionales conocidas para esta vulnerabilidad"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 2.0.0-beta1, < 7.5.15","status":"affected"},{"version":">= 8.0.0, < 8.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-22T15:49:44.646427Z","id":"CVE-2022-21702","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.1","versionEndExcluding":"7.5.15","matchCriteriaId":"EDAF22BC-1003-4EB9-8256-A7DEA894CCC1"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.5","matchCriteriaId":"16145A8D-9FF1-4EEE-8E29-198B408582B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:2.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"9C4FC3E6-8C85-4398-B270-5B0373C129B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:2.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"4C441D33-2494-4B4F-8C7D-3C0857FDD209"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:*","versionEndExcluding":"3.0","matchCriteriaId":"CC05F69D-6C6B-472D-87B7-84231F14CA8B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/commit/27726868b3d7c613844b55cd209ca93645c99b85","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-xc3p-28hw-q24g","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/commit/27726868b3d7c613844b55cd209ca93645c99b85","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-xc3p-28hw-q24g","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mitigation","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-21703","sourceIdentifier":"security-advisories@github.com","published":"2022-02-08T21:15:20.150","lastModified":"2026-06-17T04:26:48.027","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Las versiones afectadas están sujetas a una vulnerabilidad de tipo cross site request forgery que permite a atacantes elevar sus privilegios al montar ataques de origen cruzado contra usuarios autenticados de Grafana con altos privilegios (por ejemplo, editores o administradores). Un atacante puede explotar esta vulnerabilidad para una elevación de privilegios al engañar a un usuario autenticado para que invite al atacante como un nuevo usuario con altos privilegios. Se recomienda a usuarios actualizar lo antes posible. No hay medidas de mitigación adicionales conocidas para este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 3.0-beta1, < 7.5.15","status":"affected"},{"version":">= 8.0.0, < 8.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T14:11:04.630434Z","id":"CVE-2022-21703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.1","versionEndExcluding":"7.5.15","matchCriteriaId":"1F2335D6-B310-42E7-8FC8-25B8E2264829"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.5","matchCriteriaId":"16145A8D-9FF1-4EEE-8E29-198B408582B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"D738463C-2E39-42D3-A730-5A49594825CC"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"152CFB89-E06C-455E-8B72-016F44D33DA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"3E44CD01-FC42-4A90-B976-87E65F3C3E44"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta4:*:*:*:*:*:*","matchCriteriaId":"6B0D67F3-2D3C-4DB7-BF59-4719BCF8A613"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta5:*:*:*:*:*:*","matchCriteriaId":"1804B55D-0FAA-4529-9749-8342A779430D"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta6:*:*:*:*:*:*","matchCriteriaId":"EAF5DF18-EAD2-4888-B1B7-0506C0F893EB"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:3.0.0:beta7:*:*:*:*:*:*","matchCriteriaId":"9376D16C-2453-4E08-981C-4789F741FA5E"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:*","versionEndExcluding":"3.0","matchCriteriaId":"CC05F69D-6C6B-472D-87B7-84231F14CA8B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/pull/45083","source":"security-advisories@github.com","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w","source":"security-advisories@github.com","tags":["Mitigation","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"security-advisories@github.com","tags":["Mitigation","Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/pull/45083","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-21713","sourceIdentifier":"security-advisories@github.com","published":"2022-02-08T21:15:20.223","lastModified":"2026-06-17T04:26:49.230","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Las versiones afectadas de Grafana exponen varios endpoints de la API que no manejan apropiadamente la autorización del usuario. El punto API \"/teams/:teamId\" permitirá a un atacante autenticado visualizar datos no deseados al consultar por el ID del equipo específico, \"/teams/:search\" permitirá a un atacante autenticado buscar equipos y visualizar el número total de equipos disponibles, incluyendo aquellos equipos a los que el usuario no presenta acceso, y \"/teams/:teamId/members\" cuando el flag editors_can_admin está habilitada, un atacante autenticado puede visualizar datos no deseados al consultar por el ID del equipo específico. Se recomienda a usuarios actualizar lo antes posible. No hay medidas de mitigación adicionales conocidas para este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":">= 5.0.0-beta1, < 7.5.15","status":"affected"},{"version":">= 8.0.0, < 8.3.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:N/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T14:11:00.990164Z","id":"CVE-2022-21713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"7.5.15","matchCriteriaId":"7E542A7D-ABD6-401A-B091-9B51E458236A"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.5","matchCriteriaId":"16145A8D-9FF1-4EEE-8E29-198B408582B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:5.0.0:beta1:*:*:*:*:*:*","matchCriteriaId":"9109F31C-C109-48D0-A928-D5E61B6A9547"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:5.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"60242F49-9899-4B4A-BD2B-99EF2B7DD22F"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:5.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"98551C43-BD4C-40CD-92C5-6A3005022CF5"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:5.0.0:beta4:*:*:*:*:*:*","matchCriteriaId":"E76F5633-7F85-4162-BA13-6F1D887ECE83"},{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:5.0.0:beta5:*:*:*:*:*:*","matchCriteriaId":"FF03FBD9-5AA0-4171-9EC7-84BFBCBE48D4"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:*","versionEndExcluding":"3.0","matchCriteriaId":"CC05F69D-6C6B-472D-87B7-84231F14CA8B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","matchCriteriaId":"A930E247-0B43-43CB-98FF-6CE7B8189835"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","matchCriteriaId":"80E516C0-98A4-4ADE-B69F-66A772E2BAAA"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*","matchCriteriaId":"5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/pull/45083","source":"security-advisories@github.com","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"security-advisories@github.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/pull/45083","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0005/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-24812","sourceIdentifier":"security-advisories@github.com","published":"2022-04-12T17:15:09.503","lastModified":"2026-06-17T04:32:34.510","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests. This can lead to an escalation of privileges, when for example a first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin, essentially accessing higher privilege than it should. The vulnerability is only impacting Grafana Enterprise when the fine-grained access control beta feature is enabled and there are more than one API Keys in one organization with different roles assigned. All installations after Grafana Enterprise v8.1.0-beta1 should be upgraded as soon as possible. As an alternative, disable fine-grained access control will mitigate the vulnerability."},{"lang":"es","value":"Grafana es una plataforma de código abierto para la monitorización y la observabilidad. Cuando el control de acceso de grano fino está habilitado y un cliente usa la API Key de Grafana para hacer peticiones, los permisos para esa API Key se almacenan en caché durante 30 segundos para la organización dada. Debido a la forma en que es construida el ID de la caché, las peticiones consecuentes con cualquier API Key son evaluadas con los mismos permisos que las peticiones anteriores. Esto puede conllevar a una escalada de privilegios, cuando por ejemplo una primera petición es realizada con permisos de Administrador, y la segunda petición con diferente API Key es realizada con permisos de Visor, la segunda petición obtendrá los permisos almacenados en caché del Administrador anterior, accediendo esencialmente a un privilegio mayor del que debería. La vulnerabilidad sólo afecta a Grafana Enterprise cuando la función beta de control de acceso de grano fino está habilitada y presenta más de una API Key en una organización con diferentes roles asignados. Todas las instalaciones posteriores a Grafana Enterprise v8.1.0-beta1 deberían actualizarse lo antes posible. Como alternativa, deshabilitar el control de acceso de grano fino mitigará la vulnerabilidad"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grafana","product":"grafana","versions":[{"version":" >= 8.1.0-beta1, < 8.4.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:P/I:P/A:P","baseScore":6.0,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-27T00:00:00+00:00","id":"CVE-2022-24812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"8.1.0","versionEndExcluding":"8.4.6","matchCriteriaId":"78D22073-11CA-4ED7-8A39-2DA3E142A74E"}]}]}],"references":[{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-82gq-xfg3-5j7v","source":"security-advisories@github.com","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/04/12/grafana-enterprise-8.4.6-released-with-high-severity-security-fix/","source":"security-advisories@github.com","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-4-6/","source":"security-advisories@github.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220519-0005/","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-82gq-xfg3-5j7v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://grafana.com/blog/2022/04/12/grafana-enterprise-8.4.6-released-with-high-severity-security-fix/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Vendor Advisory"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-4-6/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220519-0005/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}