CVE-2022-31123mediumCWE-347

CVE-2022-31123: medium-severity vulnerability in grafana

Grafana plugin signature bypass vulnerability

Published · Updated

Follow this CVE+ Monitor Grafana+ Monitor github.com/grafana/grafana

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.3%
Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Affected products
grafana · grafana
Related CVEs — grafana

In the same product, most dangerous first.

CVE-2021-39226CRITICALSnapshot authentication bypass in grafanaEPSS 99.9%KEVCVE-2021-43798HIGHGrafana path traversalEPSS 88.5%KEVCVE-2021-41174MEDIUMXSS vulnerability allowing arbitrary JavaScript executionEPSS 85.4%CVE-2022-31097HIGHStored XSS in Grafana's Unified AlertingEPSS 70.1%CVE-2021-43813MEDIUMDirectory Traversal in GrafanaEPSS 56.6%CVE-2021-41244CRITICALCross organization admin control in GrafanaEPSS 2.9%