Grafana
Page 2 of 2 — Grafana CVEs from a corpus of 158, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-39306 | Medium | 6.4 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Valida… |
CVE-2022-39328 | Critical | 9.8 | 2022-11-08 | Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentic… |
CVE-2022-39229 | Medium | 4.3 | 2022-10-13 | Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's… |
CVE-2022-39201 | Medium | 6.8 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana coul… |
CVE-2022-31130 | Medium | 4.9 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication… |
CVE-2022-31123 | Medium | 6.1 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature… |
CVE-2022-36062 | High | 7.6 | 2022-09-22 | Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation… |
CVE-2022-35957 | Medium | 6.6 | 2022-09-20 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server ad… |
CVE-2022-31176 | High | 8.3 | 2022-09-02 | Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An interna… |
CVE-2022-31107 | High | 7.1 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious use… |
CVE-2022-31097 | High | 7.3 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerabl… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |
CVE-2022-32275 | High | 7.5 | 2022-06-06 | Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE… |
CVE-2022-29170 | Medium | 6.6 | 2022-05-20 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafan… |
CVE-2022-28660 | Critical | 9.8 | 2022-05-20 | The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1… |
CVE-2022-24812 | High | 8.0 | 2022-04-12 | Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requ… |
CVE-2022-26148 | Critical | 9.8 | 2022-03-21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When t… |
CVE-2022-21713 | Medium | 4.3 | 2022-02-08 | Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle us… |
CVE-2022-21703 | Medium | 6.3 | 2022-02-08 | Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows a… |
CVE-2022-21702 | Medium | 6.5 | 2022-02-08 | Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or p… |
CVE-2022-21673 | Medium | 4.3 | 2022-01-18 | Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, se… |
CVE-2021-43815 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv fi… |
CVE-2021-43813 | Medium | 4.3 | 2021-12-10 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability fo… |
CVE-2021-41090 | Medium | 6.5 | 2021-12-08 | Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0… |
CVE-2021-43798 | High | 7.5 | 2021-12-07 | Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to… |
CVE-2021-41244 | Critical | 9.1 | 2021-11-15 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and ther… |
CVE-2021-41174 | Medium | 6.9 | 2021-11-03 | Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencin… |
CVE-2021-39226 | Critical | 9.8 | 2021-10-05 | Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowe… |
CVE-2021-36156 | Medium | 5.3 | 2021-08-03 | An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduc… |
CVE-2021-31231 | Medium | 5.5 | 2021-04-30 | The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanag… |
CVE-2021-28148 | High | 7.5 | 2021-03-22 | One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authen… |
CVE-2021-28147 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana inst… |
CVE-2021-28146 | Medium | 6.5 | 2021-03-22 | The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication se… |
CVE-2021-27962 | High | 7.1 | 2021-03-22 | Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they sh… |
CVE-2021-27358 | High | 7.5 | 2021-03-18 | The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a com… |
CVE-2020-27846 | Critical | 9.8 | 2020-12-21 | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnera… |
CVE-2020-24303 | Medium | 6.1 | 2020-10-28 | Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. |
CVE-2019-19499 | Medium | 6.5 | 2020-08-28 | Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source… |
CVE-2020-11110 | Medium | 5.4 | 2020-07-27 | Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that… |
CVE-2020-13379 | High | 8.2 | 2020-06-03 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make… |
CVE-2018-18625 | Medium | 6.1 | 2020-06-02 | Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. |
CVE-2018-18624 | Medium | 6.1 | 2020-06-02 | Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. |
CVE-2018-18623 | Medium | 6.1 | 2020-06-02 | Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. |
CVE-2020-13430 | Medium | 6.1 | 2020-05-24 | Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. |
CVE-2020-13429 | Medium | 5.4 | 2020-05-24 | legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) option. |
CVE-2020-12459 | Medium | 5.5 | 2020-04-29 | In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_… |
CVE-2020-12458 | Medium | 5.5 | 2020-04-29 | An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are wo… |
CVE-2020-12052 | Medium | 6.1 | 2020-04-27 | Grafana version < 6.7.3 is vulnerable for annotation popup XSS. |
CVE-2020-12245 | Medium | 6.1 | 2020-04-24 | Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. |
CVE-2019-15635 | Medium | 4.9 | 2019-09-23 | An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for an… |
CVE-2019-15043 | High | 7.5 | 2019-09-03 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the… |
CVE-2019-13068 | Medium | 5.4 | 2019-06-30 | public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field). |
CVE-2015-9282 | Medium | 6.1 | 2019-02-06 | The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard… |
CVE-2018-1000816 | Medium | 5.4 | 2018-12-20 | Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Runn… |
CVE-2018-19039 | Medium | 6.5 | 2018-12-13 | Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. |
CVE-2018-15727 | Critical | 9.8 | 2018-08-29 | Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing… |
CVE-2018-12099 | Medium | 6.1 | 2018-06-11 | Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. |