Github.Com Grafana Grafana vulnerabilities

CVE-2022-39307 [MEDIUM] CWE-200 Grafana User enumeration via forget password Grafana User enumeration via forget password Today we are releasing Grafana 9.2.4. Alongside other bug fixes, this patch release includes moderate security fixes for CVE-2022-39307. We are also releasing security patches for Grafana 8.5.15 to fix these issues. Release 9.2.4, latest patch, also containing security fix: - [Download Grafana 9.2.4](https://grafana.com/grafana/download/9.2.4) Release 8.5.15, only contai

CVE-2023-22462 [MEDIUM] CWE-79 Grafana vulnerable to Stored Cross-site Scripting in Text plugin Grafana vulnerable to Stored Cross-site Scripting in Text plugin ### Description On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass tho

CVE-2024-6322 [MEDIUM] CWE-266 Grafana plugin data sources vulnerable to access control bypass Grafana plugin data sources vulnerable to access control bypass Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

CVE-2018-18623 [MEDIUM] CWE-79 Grafana XSS in Dashboard Text Panel Grafana XSS in Dashboard Text Panel Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

CVE-2023-6152 [MEDIUM] CWE-863 Email Validation Bypass And Preventing Sign Up From Email's Owner Email Validation Bypass And Preventing Sign Up From Email's Owner ### Summary Email validation can easily be bypassed because `verify_email_enabled` option enable email validation at sign up only. A user changing it's email after signing up (and verifying it) can change it without verification in `/profile`. This can be used to prevent legitimate owner of the email address from signing up. Another

CVE-2023-2801 [HIGH] CWE-662 Grafana Missing Synchronization vulnerability Grafana Missing Synchronization vulnerability Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directl

CVE-2018-18624 [MEDIUM] CWE-79 Grafana XSS via a column style Grafana XSS via a column style Grafana has a XSS vulnerability via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

CVE-2018-18625 [MEDIUM] CWE-79 Grafana XSS via adding a link in General feature Grafana XSS via adding a link in General feature Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

CVE-2020-24303 [MEDIUM] CWE-79 Grafana XSS via a query alias for the ElasticSearch datasource Grafana XSS via a query alias for the ElasticSearch datasource Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

CVE-2020-12245 [MEDIUM] CWE-79 Grafana XSS in header column rename Grafana XSS in header column rename Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

CVE-2020-13430 [MEDIUM] CWE-79 Grafana XSS via the OpenTSDB datasource Grafana XSS via the OpenTSDB datasource Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

CVE-2022-21713 [MEDIUM] CWE-639 Grafana API IDOR Grafana API IDOR Today we are releasing Grafana 8.3.5 and 7.5.14. This patch release includes MEDIUM severity security fix for Grafana Teams API IDOR. Release v.8.3.5, only containing security fixes: - [Download Grafana 8.3.5](https://grafana.com/grafana/download/8.3.5) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-5/) Release v.7.5.15, only containing security fixes: - [Download Grafana 7.5.15](htt

CVE-2018-12099 [MEDIUM] CWE-79 Grafana Cross-site Scripting (XSS) Grafana Cross-site Scripting (XSS) Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

CVE-2026-10601 [MEDIUM] CWE-22 Grafana: Path traversal in the Tempo and Loki data source plugins Grafana: Path traversal in the Tempo and Loki data source plugins The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invok

CVE-2018-1000816 [MEDIUM] CWE-79 Grafana XSS Vulnerability Grafana XSS Vulnerability Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..

CVE-2020-12458 [HIGH] CWE-312 Grafana information disclosure Grafana information disclosure An information-disclosure flaw was found in Grafana. The database directory `/var/lib/grafana` and database file `/var/lib/grafana/grafana.db` are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords).

CVE-2026-21724 [MEDIUM] CWE-285 Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers

CVE-2020-12459 [HIGH] CWE-200 Grafana world readable configuration files Grafana world readable configuration files In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files `/etc/grafana/grafana.ini` and `/etc/grafana/ldap.toml` (which contain a secret_key and a bind_password) are world readable.

CVE-2022-39229 [MEDIUM] CWE-287 Grafana when using email as a username can block other users from signing in Grafana when using email as a username can block other users from signing in Today we are releasing Grafana 9.2. Alongside with new features and other bug fixes, this release includes a Moderate severity security fix for CVE-2022-39229 We are also releasing security patches for Grafana 9.1.8 and Grafana 8.5.14 to fix these issues. Release 9.2, latest release, also containing security f

CVE-2023-1410 [MEDIUM] CWE-79 Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip ### Summary When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use `Functions`. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your quer