CVE-2022-31176
Summary
| CVE | CVE-2022-31176 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-09-02 21:15:00 UTC |
|---|
| Updated | 2023-07-24 13:07:00 UTC |
|---|
| Description | Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer). |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Grafana Image Renderer leaking files · Advisory · grafana/grafana-image-renderer · GitHub |
CONFIRM |
github.com |
|
| CVE-2022-31176 Grafana Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| Security: Add support for auth token by joanlopez · Pull Request #364 · grafana/grafana-image-renderer · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 502501 Alpine Linux Security Update for grafana
- 502867 Alpine Linux Security Update for grafana
- 690931 Free Berkeley Software Distribution (FreeBSD) Security Update for grafana (827b95ff-290e-11ed-a2e7-6c3be5272acd)
