Cross Site Request Forgery in Grafana
Priority MEDIUM 42CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.
Summary
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02283 83rd percentileScored 2026-11-07
Fix Partial grafana (grafana): 7.5.15, 8.3.5github.com/grafana/grafana/pkg/web (Go): 7.5.15, 8.3.5Red Hat: 2 advisoriesRed Hat: 2 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | grafana | 3.0-beta1 to before 7.5.15; 8.0.0 to before 8.3.5 | 7.5.15, 8.3.5 | Patch available | CNA |
| — | github.com/grafana/grafana/pkg/web (Go) | 3.0-beta1 to before 7.5.15 | 7.5.15 | Patch available | GHSA-cmf4-h3xc-jw8w |
| — | github.com/grafana/grafana/pkg/web (Go) | 8.0.0 to before 8.3.5 | 8.3.5 | Patch available | GHSA-cmf4-h3xc-jw8w |
- grafana VendorGrafana Affected 3.0-beta1 to before 7.5.15; 8.0.0 to before 8.3.5 Fixed in 7.5.15, 8.3.5 Patch available CNA
- github.com/grafana/grafana/pkg/web (Go) Vendor— Affected 3.0-beta1 to before 7.5.15 Fixed in 7.5.15 Patch available GHSA-cmf4-h3xc-jw8w
- github.com/grafana/grafana/pkg/web (Go) Vendor— Affected 8.0.0 to before 8.3.5 Fixed in 8.3.5 Patch available GHSA-cmf4-h3xc-jw8w
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* | 3.0.1 to before 7.5.15; 8.0.0 to before 8.3.5 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta3:*:*:*:*:*:* | 3.0.0 beta3 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta4:*:*:*:*:*:* | 3.0.0 beta4 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta5:*:*:*:*:*:* | 3.0.0 beta5 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta6:*:*:*:*:*:* | 3.0.0 beta6 | Vulnerable | Grafana |
| cpe:2.3:a:grafana:grafana:3.0.0:beta7:*:*:*:*:*:* | 3.0.0 beta7 | Vulnerable | Grafana |
| cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 3.0.1 to before 7.5.15; 8.0.0 to before 8.3.5 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta5:*:*:*:*:*:* Versions 3.0.0 beta5 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta6:*:*:*:*:*:* Versions 3.0.0 beta6 Vulnerable ·Grafana
- cpe:2.3:a:grafana:grafana:3.0.0:beta7:*:*:*:*:*:* Versions 3.0.0 beta7 Vulnerable ·Grafana
- cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA grafana (grafana) Fixed in 7.5.15, 8.3.5
- Fix · GHSA-cmf4-h3xc-jw8w github.com/grafana/grafana/pkg/web (Go) Fixed in 7.5.15 Advisory →
- Fix · GHSA-cmf4-h3xc-jw8w github.com/grafana/grafana/pkg/web (Go) Fixed in 8.3.5 Advisory →
Red Hat 2 advisories
- RHSA-2022:8057 Released 2022-11-15 · Red Hat rating Importantgrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-7.5.15-3.el9
- RHSA-2022:7519 Released 2022-11-08 · Red Hat rating Moderategrafana security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-7.5.15-3.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| OpenShift Service Mesh 2.1 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7519 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:8057 |
Not affected: 2 products
- Red Hat 3scale API Management Platform 2
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21703
- 2026-10-03 Alias added: GHSA-cmf4-h3xc-jw8w
References
Advisory 7
- https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
- https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w
- https://security.netapp.com/advisory/ntap-20220303-0005/
- FEDORA-2022-83405f9d5b
- FEDORA-2022-9dd03cab55
- FEDORA-2022-c5383675d9
- https://nvd.nist.gov/vuln/detail/CVE-2022-21703
Other 5
- https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D
- https://lists.fedoraproject.org/archives/list/[email protected]/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ
- https://security.netapp.com/advisory/ntap-20220303-0005
More Grafana vulnerabilities
- TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
Sources
- CVE-2022-21703 · CVE Program
- CVE-2022-21703 · NVD
- FIRST EPSS
- GHSA-cmf4-h3xc-jw8w · GitHub Advisory Database · CC BY 4.0
- CVE-2022-21703 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences