CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2022-31123
High (7.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/grafana/grafana 8.5.14, 9.1.8.
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWE
- CWE-347
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
- netapp:e-series_performance_analyzer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rhxj-gh46-jvw8 | Go | github.com/grafana/grafana | >=9.0.0 <9.1.8 | 9.1.8 |
| GHSA-rhxj-gh46-jvw8 | Go | github.com/grafana/grafana | >=7.0.0 <8.5.14 | 8.5.14 |
| GO-2024-2855 | Go | github.com/grafana/grafana | all versions | no fix published |
References
- https://github.com/grafana/grafana/releases/tag/v9.1.8
- https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8
- https://security.netapp.com/advisory/ntap-20221124-0002/
- https://github.com/grafana/grafana/releases/tag/v9.1.8
- https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8