The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafana | Nov 14, 2022 | Feb 8, 2022 |
| Alpine Linux | — | Upgrade grafana | Aug 22, 2024 | Feb 8, 2022 |
| Centos_linux | — | Upgrade grafana-debuginfoUpgrade grafana | Nov 9, 2022 | Feb 8, 2022 |
| Freebsd | — | Upgrade grafana6Upgrade grafana8Upgrade grafana7 | Nov 4, 2022 | Feb 12, 2022 |
| Oracle_linux | — | Upgrade grafana | Nov 16, 2022 | Feb 8, 2022 |
| Redhat_linux | — | Upgrade grafana-debuginfoUpgrade grafana | Nov 9, 2022 | Feb 8, 2022 |
| Rocky_linux | — | Upgrade grafanaUpgrade grafana-debuginfo | Mar 12, 2024 | Feb 8, 2022 |
| Suse | — | Upgrade prometheus-postgres_exporterUpgrade golang-github-prometheus-node_exporterUpgrade python3-rhnlibUpgrade spacecmdUpgrade grafana | Oct 26, 2022 | Feb 8, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub