CVE-2022-39201 - CVE House

Back to Database

Status published Medium CVE-2022-39201

Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

6.8 CVSS

Vulnerability Description

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39201

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from grafana

View All →

Stored XSS in Grafana Text plugin

Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information

Access policy with access to all tenants and using label selectors has more access

Grafana vulnerable to race condition allowing privilege escalation

Grafana vulnerable to spoofing originalUrl of snapshots

Affected Vendor

grafana

View all reports →

Affected Software

grafana

Vulnerable Versions:

>= v5.0.0-beta1, < 8.5.14, >= 9.0.0, < 9.1.8

Timeline

Official Publish: October 13th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel