{"id":"CVE-2022-31097","published":"2022-07-15T12:10:10Z","modified":"2026-01-28T04:55:34Z","title":"Stored XSS in Grafana's Unified Alerting","vendor":"grafana","product":"grafana","tier":"core","eol":null,"affectedVersions":[{"vendor":"grafana","product":"grafana","versions":[">= 9.0.0, < 9.0.3",">= 8.5.0, < 8.5.9",">= 8.4.0, < 8.4.10",">= 8.0.0, < 8.3.10"]}],"description":{"text":"Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.","provenance":"source","from":"CVE.org"},"summary":{"text":"A stored cross-site scripting flaw in the Unified Alerting feature of Grafana, the open-source monitoring and observability platform, affects its 8.x and 9.x releases before the patched versions. An authenticated user with editor rights can exploit it, with user interaction required: by getting an authenticated administrator to click a link, the attacker can escalate their privileges from editor to admin.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:43Z"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.7006,"percentile":0.99374,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f","tags":["x_refsource_CONFIRM"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/","tags":["x_refsource_MISC"]},{"url":"https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/","tags":["x_refsource_MISC"]},{"url":"https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220901-0010/","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=9.0.0, <9.0.3",">=8.5.0, <8.5.9",">=8.4.0, <8.4.10",">=8.0.0, <8.3.10","all versions"],"patched":["9.0.3","8.5.9","8.4.10","8.3.10"],"from":["GHSA-vw7q-p2qg-4m5f","GO-2024-2857"],"provenance":"source"}],"advisories":[{"id":"GHSA-vw7q-p2qg-4m5f","url":"https://github.com/advisories/GHSA-vw7q-p2qg-4m5f","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=9.0.0, <9.0.3"],"patched":["9.0.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vw7q-p2qg-4m5f","url":"https://github.com/advisories/GHSA-vw7q-p2qg-4m5f","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=8.5.0, <8.5.9"],"patched":["8.5.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vw7q-p2qg-4m5f","url":"https://github.com/advisories/GHSA-vw7q-p2qg-4m5f","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=8.4.0, <8.4.10"],"patched":["8.4.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vw7q-p2qg-4m5f","url":"https://github.com/advisories/GHSA-vw7q-p2qg-4m5f","severity":"MODERATE","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=8.0.0, <8.3.10"],"patched":["8.3.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-1819","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1819","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-07-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-31097","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9937"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.11,"detail":"base score 7.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2021-43815","published":"2021-12-10","fixed":"8.3.2","kev":false},{"cve":"CVE-2022-21702","published":"2022-02-08","fixed":"8.3.5","kev":false},{"cve":"CVE-2022-21713","published":"2022-02-08","fixed":"8.3.5","kev":false,"link":{"from":"CVE-2022-21713","to":"CVE-2022-31097","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.3.5","toFixed":"8.3.10","daysApart":157}]}},{"cve":"CVE-2022-31097","published":"2022-07-15","fixed":"9.0.3","kev":false},{"cve":"CVE-2022-31107","published":"2022-07-15","fixed":"9.0.3","kev":false},{"cve":"CVE-2022-35957","published":"2022-09-20","fixed":"9.1.6","kev":false,"link":{"from":"CVE-2022-31097","to":"CVE-2022-35957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.5.9","toFixed":"8.5.13","daysApart":67},{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"9.0.3","toFixed":"9.0.9","daysApart":67}]}},{"cve":"CVE-2022-36062","published":"2022-09-22","fixed":"9.1.6","kev":false,"link":{"from":"CVE-2022-31097","to":"CVE-2022-36062","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"8.5.9","toFixed":"8.5.13","daysApart":69},{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"9.0.3","toFixed":"9.0.9","daysApart":69}]}}],"package":"Go:github.com/grafana/grafana"}}