CVE-2022-31097
Fixed in a distro release EPSS 70%CVSS 7.3
Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
Products: grafana
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 9.0.3 |
| Go | github.com/grafana/grafana | 8.5.9 |
| Go | github.com/grafana/grafana | 8.4.10 |
| Go | github.com/grafana/grafana | 8.3.10 |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| SUSE Enterprise Storage 6 | grafana | 8.5.13-150100.3.12.1 |
| SUSE Enterprise Storage 7 | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.18.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.18.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | grafana | 9.5.1-150200.3.41.3 |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | grafana | 8.5.13-150200.3.29.5 |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | grafana | 8.3.10-150200.3.26.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | grafana | 9.5.1-150200.3.41.3 |
| SUSE Linux Enterprise Server 12 SP3-BCL | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Linux Enterprise Server 12 SP5 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise Server 15-LTSS | golang-github-prometheus-node_exporter | 1.3.0-150000.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | golang-github-prometheus-node_exporter | 1.3.0-150000.3.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | bind | 9.16.6-150000.12.65.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | bind | 9.16.6-150000.12.65.1 |
| SUSE Manager Client Tools 12 | golang-github-boynux-squid_exporter | 1.6-1.9.1 |
| SUSE Manager Client Tools 12 | golang-github-lusitaniae-apache_exporter | 0.11.0-1.13.1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.23.0-1.15.2 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE Manager Client Tools 12 | grafana | 8.5.13-1.36.2 |
| SUSE Manager Client Tools 12 | grafana | 9.5.1-1.48.1 |
| SUSE Manager Client Tools 12 | grafana | 8.3.10-1.33.2 |
| SUSE Manager Client Tools 12 | kiwi-desc-saltboot | 0.1.1661440542.6cbe0da-1.29.1 |
| SUSE Manager Client Tools 12 | mgr-daemon | 4.3.6-1.38.1 |
| SUSE Manager Client Tools 12 | mgr-daemon | 4.3.7-1.41.1 |
| SUSE Manager Client Tools 12 | prometheus-blackbox_exporter | 0.19.0-1.14.1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.3.21-38.121.1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.3.15-38.109.1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.3.16-38.112.1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.3.12-52.77.1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.3.13-52.80.1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.3.6-1.27.1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.3.8-1.33.1 |
| SUSE Manager Client Tools 12 | zypp-plugin-spacewalk | 1.0.14-30.42.1 |
| SUSE Manager Client Tools 12-BETA | golang-github-QubitProducts-exporter_exporter | 0.4.0-4.6.2 |
| SUSE Manager Client Tools 12-BETA | golang-github-boynux-squid_exporter | 1.6-4.9.2 |
| SUSE Manager Client Tools 12-BETA | golang-github-lusitaniae-apache_exporter | 1.0.0-4.12.4 |
| SUSE Manager Client Tools 12-BETA | golang-github-prometheus-alertmanager | 0.26.0-4.12.4 |
| SUSE Manager Client Tools 12-BETA | golang-github-prometheus-node_exporter | 1.5.0-4.15.4 |
| SUSE Manager Client Tools 12-BETA | golang-github-prometheus-prometheus | 2.45.0-4.33.3 |
| SUSE Manager Client Tools 12-BETA | golang-github-prometheus-promu | 0.14.0-4.12.2 |
| SUSE Manager Client Tools 12-BETA | grafana | 9.5.8-4.21.2 |
| SUSE Manager Client Tools 12-BETA | kiwi-desc-saltboot | 0.1.1687520761.cefb248-4.15.2 |
| SUSE Manager Client Tools 12-BETA | mgr-push | 5.0.1-4.21.4 |
| SUSE Manager Client Tools 12-BETA | prometheus-blackbox_exporter | 0.24.0-3.6.3 |
| SUSE Manager Client Tools 12-BETA | prometheus-postgres_exporter | 0.10.1-3.6.4 |
| SUSE Manager Client Tools 12-BETA | python-hwdata | 2.3.5-15.12.2 |
| SUSE Manager Client Tools 12-BETA | rhnlib | 5.0.1-24.30.3 |
| SUSE Manager Client Tools 12-BETA | spacecmd | 5.0.1-41.42.3 |
| SUSE Manager Client Tools 12-BETA | supportutils-plugin-salt | 1.2.2-9.9.2 |
| SUSE Manager Client Tools 12-BETA | supportutils-plugin-susemanager-client | 5.0.1-9.15.2 |
| SUSE Manager Client Tools 12-BETA | system-user-grafana | 1.0.0-3.7.2 |
| SUSE Manager Client Tools 12-BETA | system-user-prometheus | 1.0.0-3.7.2 |
| SUSE Manager Client Tools 12-BETA | uyuni-common-libs | 5.0.1-3.33.3 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1681904360.84ef141-150000.1.50.1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1661440542.6cbe0da-150000.1.38.1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 |
| SUSE Manager Client Tools 15 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 |
| SUSE Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| SUSE Manager Client Tools 15 | grafana | 8.5.13-150000.1.36.3 |
| SUSE Manager Client Tools 15 | grafana | 9.5.1-150000.1.48.5 |
| SUSE Manager Client Tools 15 | grafana | 8.3.10-150000.1.33.1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.6-150000.1.38.1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.7-150000.1.41.1 |
| SUSE Manager Client Tools 15 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.21-150000.3.98.1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.15-150000.3.86.1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.16-150000.3.89.1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.12-150000.3.68.2 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.13-150000.3.71.3 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.8-150000.1.33.1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.6-150000.1.27.2 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.7-150000.1.9.3 |
| SUSE Manager Client Tools 15 | zypp-plugin-spacewalk | 1.0.14-150000.3.35.1 |
| SUSE Manager Client Tools 15-BETA | ansible | 2.9.27-159000.3.9.1 |
| SUSE Manager Client Tools 15-BETA | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-boynux-squid_exporter | 1.6-159000.4.9.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-lusitaniae-apache_exporter | 1.0.0-159000.4.12.1 |
| SUSE Manager Client Tools 15-BETA | golang-github-prometheus-prometheus | 2.45.0-159000.6.33.1 |
| SUSE Manager Client Tools 15-BETA | grafana | 9.5.8-159000.4.24.1 |
| SUSE Manager Client Tools 15-BETA | mgr-push | 5.0.1-159000.4.21.1 |
| SUSE Manager Client Tools 15-BETA | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | prometheus-postgres_exporter | 0.10.1-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | python-hwdata | 2.3.5-159000.5.13.1 |
| SUSE Manager Client Tools 15-BETA | python-pyvmomi | 6.7.3-159000.3.6.1 |
| SUSE Manager Client Tools 15-BETA | rhnlib | 5.0.1-159000.6.30.1 |
| SUSE Manager Client Tools 15-BETA | spacecmd | 5.0.1-159000.6.42.1 |
| SUSE Manager Client Tools 15-BETA | spacewalk-client-tools | 5.0.1-159000.6.48.1 |
| SUSE Manager Client Tools 15-BETA | supportutils-plugin-salt | 1.2.2-159000.5.9.1 |
| SUSE Manager Client Tools 15-BETA | supportutils-plugin-susemanager-client | 5.0.1-159000.6.15.1 |
| SUSE Manager Client Tools 15-BETA | uyuni-common-libs | 5.0.1-159000.3.33.1 |
| SUSE Manager Client Tools 15-BETA | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | dracut-saltboot | 0.1.1681904360.84ef141-159000.3.30.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0.4.0-159000.4.6.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | prometheus-blackbox_exporter | 0.24.0-159000.3.6.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-proxy-systemd-services | 5.0.1-159000.3.9.1 |
| SUSE Manager Client Tools for SLE Micro 5 | bind | 9.16.6-150000.12.65.1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1681904360.84ef141-150000.1.50.1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 |
| SUSE Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.7-150000.1.9.3 |
| SUSE Manager Proxy Module 4.2 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 |
| SUSE Manager Proxy Module 4.2 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| SUSE Manager Proxy Module 4.2 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 |
| SUSE Manager Proxy Module 4.2 | zypp-plugin-spacewalk | 1.0.14-150000.3.35.1 |
| SUSE Manager Proxy Module 4.3 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 |
| SUSE Manager Proxy Module 4.3 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| SUSE Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 |
| SUSE Manager Proxy Module 4.3 | zypp-plugin-spacewalk | 1.0.14-150000.3.35.1 |
| SUSE Manager Server Module 4.2 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| SUSE Manager Server Module 4.3 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| SUSE OpenStack Cloud 9 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| SUSE OpenStack Cloud Crowbar 9 | golang-github-prometheus-node_exporter | 1.3.0-1.21.1 |
| Ubuntu 16.04 LTS | grafana | no fix |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1661440542.6cbe0da-150000.1.38.1 |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 |
| openSUSE Leap 15.3 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 |
| openSUSE Leap 15.3 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| openSUSE Leap 15.3 | golang-github-prometheus-promu | 0.13.0-150000.3.9.1 |
| openSUSE Leap 15.3 | grafana | 8.5.13-150200.3.29.5 |
| openSUSE Leap 15.3 | grafana | 8.3.10-150200.3.26.1 |
| openSUSE Leap 15.3 | spacecmd | 4.3.15-150000.3.86.1 |
| openSUSE Leap 15.3 | spacecmd | 4.3.16-150000.3.89.1 |
| openSUSE Leap 15.4 | bind | 9.16.6-150000.12.65.1 |
| openSUSE Leap 15.4 | dracut-saltboot | 0.1.1665997480.587fa10-150000.1.41.1 |
| openSUSE Leap 15.4 | dracut-saltboot | 0.1.1681904360.84ef141-150000.1.50.1 |
| openSUSE Leap 15.4 | dracut-saltboot | 0.1.1661440542.6cbe0da-150000.1.38.1 |
| openSUSE Leap 15.4 | golang-github-boynux-squid_exporter | 1.6-150000.1.9.1 |
| openSUSE Leap 15.4 | golang-github-lusitaniae-apache_exporter | 0.11.0-150000.1.12.1 |
| openSUSE Leap 15.4 | golang-github-prometheus-promu | 0.13.0-150000.3.9.1 |
| openSUSE Leap 15.4 | grafana | 8.3.10-150200.3.26.1 |
| openSUSE Leap 15.4 | grafana | 9.5.1-150200.3.41.3 |
| openSUSE Leap 15.4 | grafana | 8.5.13-150200.3.29.5 |
| openSUSE Leap 15.4 | prometheus-blackbox_exporter | 0.19.0-150000.1.14.3 |
| openSUSE Leap 15.4 | spacecmd | 4.3.16-150000.3.89.1 |
| openSUSE Leap 15.4 | spacecmd | 4.3.15-150000.3.86.1 |
| openSUSE Leap 15.4 | spacecmd | 4.3.21-150000.3.98.1 |
| openSUSE Leap 15.4 | wire | 0.5.0-150000.1.12.3 |
| openSUSE Leap 15.4 | wire | 0.5.0-150000.1.9.3 |
| openSUSE Leap 15.5 | dracut-saltboot | 0.1.1681904360.84ef141-150000.1.50.1 |
| openSUSE Leap 15.5 | grafana | 9.5.1-150200.3.41.3 |
| openSUSE Leap 15.5 | spacecmd | 4.3.21-150000.3.98.1 |
| openSUSE Leap 15.5 | wire | 0.5.0-150000.1.12.3 |
| openSUSE Tumbleweed | grafana | 8.3.10-1.1 |