CVE-2022-39324

Publication date 27 January 2023

Last updated 26 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
grafana	22.10 kinetic	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not in release
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Vulnerable
	14.04 LTS trusty	Ignored end of standard support

Notes

alexmurray

A quick look at the code and it appears that grafana in xenial may be affected by this - but needs a closer look

Severity score breakdown

Parameter	Value
Base score	6.7 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L