Read the docs
TI-2022-13141 Aliases CVE-2022-31097GHSA-vw7q-p2qg-4m5f

Stored XSS in Grafana's Unified Alerting

Priority HIGH 77CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.7006 99th percentileScored 2026-11-07
Fix Partial grafana (grafana): 9.0.3, 8.5.9, 8.4.10 +1github.com/grafana/grafana (Go): 9.0.3, 8.5.9, 8.4.10 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Grafanagrafana9.0.0 to before 9.0.3; 8.5.0 to before 8.5.9; 8.4.0 to before 8.4.10; 8.0.0 to before 8.3.109.0.3, 8.5.9, 8.4.10, 8.3.10Patch availableCNA
—github.com/grafana/grafana (Go)9.0.0 to before 9.0.39.0.3Patch availableGHSA-vw7q-p2qg-4m5f
—github.com/grafana/grafana (Go)8.5.0 to before 8.5.98.5.9Patch availableGHSA-vw7q-p2qg-4m5f
—github.com/grafana/grafana (Go)8.4.0 to before 8.4.108.4.10Patch availableGHSA-vw7q-p2qg-4m5f
—github.com/grafana/grafana (Go)8.0.0 to before 8.3.108.3.10Patch availableGHSA-vw7q-p2qg-4m5f
  • grafana VendorGrafana Affected 9.0.0 to before 9.0.3; 8.5.0 to before 8.5.9; 8.4.0 to before 8.4.10; 8.0.0 to before 8.3.10 Fixed in 9.0.3, 8.5.9, 8.4.10, 8.3.10 Patch available CNA
  • github.com/grafana/grafana (Go) Vendor— Affected 9.0.0 to before 9.0.3 Fixed in 9.0.3 Patch available GHSA-vw7q-p2qg-4m5f
  • github.com/grafana/grafana (Go) Vendor— Affected 8.5.0 to before 8.5.9 Fixed in 8.5.9 Patch available GHSA-vw7q-p2qg-4m5f
  • github.com/grafana/grafana (Go) Vendor— Affected 8.4.0 to before 8.4.10 Fixed in 8.4.10 Patch available GHSA-vw7q-p2qg-4m5f
  • github.com/grafana/grafana (Go) Vendor— Affected 8.0.0 to before 8.3.10 Fixed in 8.3.10 Patch available GHSA-vw7q-p2qg-4m5f

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*8.0.0 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.3VulnerableGrafana
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.3.10; 8.4.0 to before 8.4.10; 8.5.0 to before 8.5.9; 9.0.0 to before 9.0.3 Vulnerable ·Grafana
  • cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA grafana (grafana) Fixed in 9.0.3, 8.5.9, 8.4.10, 8.3.10
  • Fix · GHSA-vw7q-p2qg-4m5f github.com/grafana/grafana (Go) Fixed in 9.0.3 Advisory →
  • Fix · GHSA-vw7q-p2qg-4m5f github.com/grafana/grafana (Go) Fixed in 8.5.9 Advisory →
  • Fix · GHSA-vw7q-p2qg-4m5f github.com/grafana/grafana (Go) Fixed in 8.4.10 Advisory →
  • Fix · GHSA-vw7q-p2qg-4m5f github.com/grafana/grafana (Go) Fixed in 8.3.10 Advisory →

Red Hat 1 advisory

  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Storage 3AffectedNo fix yet
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Not affected: 5 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31097
  2. 2026-10-03 Alias added: GHSA-vw7q-p2qg-4m5f

References

Advisory 6

Other 5

  • TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
  • TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
  • TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
  • TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
  • TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences