CVE-2022-31097
MediumGrafana Stored Cross-site Scripting in Unified Alerting
Published May 14, 2024 · Updated Sep 10, 2026 · Also known as BIT-grafana-2022-31097, GHSA-vw7q-p2qg-4m5f, GO-2024-2857, SUSE-SU-2022:3751-1, UBUNTU-CVE-2022-31097
Key Facts
Patch immediately- CVE-2022-31097 is a medium-severity vulnerability (CVSS 6.3 v4) affecting Grafana, E-Series Performance Analyzer (Netapp), grafana-fips-12.0 (chainguard) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including ansible 2.9.27-159000.3.9.1, ansible-doc 2.9.27-159000.3.9.1, bind 9.16.6-150000.12.65.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v4
6.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-31097 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
Affected Products
400 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GrafanaGrafana | >= 8.0.0, >= >= 9.0.0, < 9.0.3 | 8.3.10 |
| E-Series Performance AnalyzerNetapp | See advisory | n/a |
| grafana-fips-12.0chainguard | See advisory | 12.0.10-r6 |
| grafana-fips-12.1chainguard | See advisory | 12.1.10.01-r3 |
| grafana-fips-13.1chainguard | See advisory | 13.1.0-r0 |
Patched Releases
ansible
2.9.27-159000.3.9.1
ansible-doc
2.9.27-159000.3.9.1
bind
9.16.6-150000.12.65.1
bind-chrootenv
9.16.6-150000.12.65.1
bind-devel
9.16.6-150000.12.65.1
bind-devel-32bit
9.16.6-150000.12.65.1
bind-doc
9.16.6-150000.12.65.1
bind-utils
9.16.6-150000.12.65.1
dracut-saltboot
0.1.1661440542.6cbe0da-150000.1.38.1, 0.1.1665997480.587fa10-150000.1.41.1, 0.1.1681904360.84ef141-150000.1.50.1, 0.1.1681904360.84ef141-159000.3.30.1
firewalld-prometheus-config
0.1-159000.6.33.1
github.com/grafana/grafana
8.3.10, 8.4.10, 8.5.9, 9.0.3
golang-github-boynux-squid_exporter
1.6-1.9.1, 1.6-150000.1.9.1, 1.6-159000.4.9.1, 1.6-4.9.2
golang-github-lusitaniae-apache_exporter
0.11.0-1.13.1, 0.11.0-150000.1.12.1, 1.0.0-159000.4.12.1, 1.0.0-4.12.4
golang-github-prometheus-alertmanager
0.23.0-1.15.2, 0.26.0-4.12.4
golang-github-prometheus-node_exporter
1.3.0-1.21.1, 1.3.0-150000.3.18.1, 1.5.0-4.15.4
golang-github-prometheus-prometheus
2.45.0-159000.6.33.1, 2.45.0-4.33.3
golang-github-prometheus-promu
0.13.0-150000.3.9.1, 0.14.0-4.12.2
golang-github-QubitProducts-exporter_exporter
0.4.0-159000.4.6.1, 0.4.0-4.6.2
Grafana
8.3.10, 8.3.10-1.1, 8.3.10-1.33.2, 8.3.10-150000.1.33.1, 8.3.10-150200.3.26.1, 8.4.10, 8.5.13-1.36.2, 8.5.13-150000.1.36.3, 8.5.13-150100.3.12.1, 8.5.13-150200.3.29.5, 8.5.9, 8.5.9-r0, 9.0.3, 9.0.3-r0, 9.5.1-1.48.1, 9.5.1-150000.1.48.5, 9.5.1-150200.3.41.3, 9.5.8-159000.4.24.1, 9.5.8-4.21.2
grafana-11.4
11.4.3-r0
grafana-fips-12.0
12.0.10-r6
grafana-fips-12.1
12.1.10.01-r3
grafana-fips-13.1
13.1.0-r0
kiwi-desc-saltboot
0.1.1661440542.6cbe0da-1.29.1, 0.1.1687520761.cefb248-4.15.2
libbind9-1600
9.16.6-150000.12.65.1
Timeline
Publicly disclosed
May 14, 2024
Last updated
Sep 10, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryRHSA-2023:3642
- advisoryhttps://bugzilla.suse.com/1047218
- advisoryhttps://bugzilla.suse.com/1172110
- advisoryhttps://bugzilla.suse.com/1176460
- advisoryhttps://bugzilla.suse.com/1180816
FAQ
Common Questions.
Grafana is an open-source platform for monitoring and observability.
Affected: Grafana versions >= 8.0.0, >= >= 9.0.0, < 9.0.3; E-Series Performance Analyzer (Netapp); grafana-fips-12.0 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ansible 2.9.27-159000.3.9.1, ansible-doc 2.9.27-159000.3.9.1, bind 9.16.6-150000.12.65.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-31097 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo