CVE-2022-39324 - CVE House
Back to Database
Status published Medium CVE-2022-39324

Grafana vulnerable to spoofing originalUrl of snapshots

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39324

Credits & Attribution

No credits recorded in the NVD database.

References

More from grafana

View All →
CVE-2023-22462
Stored XSS in Grafana Text plugin
Medium 6.4
CVE-2022-46156
Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information
High 7.2
CVE-2022-44643
Access policy with access to all tenants and using label selectors has more access
Medium 5.7
CVE-2022-39328
Grafana vulnerable to race condition allowing privilege escalation
Critical 9.8
CVE-2022-39307
Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password
Medium 6.7

Affected Vendor

Affected Software

grafana
Vulnerable Versions:
< 8.5.16, >= 9.0.0, < 9.2.8

Timeline

Official Publish: January 27th, 2023
Last Modified: January 28th, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact