Read the docs
TI-2022-07605 Aliases CVE-2022-23552

Grafana stored XSS in FileUploader component

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00815 57th percentileScored 2026-11-07
Fix Fixed grafana (grafana): 9.2.10, 9.3.4, 8.5.16Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Grafanagrafana9.0 to before 9.2.10; 9.3 to before 9.3.4; 8.1 to before 8.5.169.2.10, 9.3.4, 8.5.16Patch availableCNA
  • grafana VendorGrafana Affected 9.0 to before 9.2.10; 9.3 to before 9.3.4; 8.1 to before 8.5.16 Fixed in 9.2.10, 9.3.4, 8.5.16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*8.1.0 to before 8.5.16; 9.0.0 to before 9.2.10; 9.3.0 to before 9.3.4VulnerableGrafana
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 8.1.0 to before 8.5.16; 9.0.0 to before 9.2.10; 9.3.0 to before 9.3.4 Vulnerable ·Grafana

Remediation

  • Fix · CNA grafana (grafana) Fixed in 9.2.10, 9.3.4, 8.5.16

Red Hat 1 advisory

  • RHSA-2023:6420 Released 2023-11-07 · Red Hat rating Moderate
    grafana security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-7.el9_3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:6420
Not affected: 8 products
  • OpenShift Service Mesh 2.1
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 4
  • Red Hat Ceph Storage 5
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23552
  2. 2026-11-03 CISA SSVC decision points changed

References

Patch 4

Advisory 1

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences