CVE-2022-39324

CVE Details

Release Date:	2023-01-30
Impact:	Moderate	What is this?

Description

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker's injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

See more information about CVE-2022-39324 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.7
Vector String:	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Version:	3.0
Attack Vector:	Network
Attack Complexity:	High
Privileges Required:	Low
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	Low

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (grafana)	ELSA-2023-6420	2023-11-11