CVE-2022-23552 - Grafana stored XSS in FileUploader component

Back Back to CVE browser

HIGH

Grafana stored XSS in FileUploader component

Published Jan 27, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.78%

Description

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance.

An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.

Affected products

Vendor Grafana Product Grafana Default
n/a
- Version
  >= 8.1, < 8.5.16
  Status
  affected
  Constraints
  -
- Version
  >= 9.0, < 9.2.10
  Status
  affected
  Constraints
  -
- Version
  >= 9.3, < 9.3.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Grafana

n/a

Version	Status	Constraints
>= 8.1, < 8.5.16	affected	-
>= 9.0, < 9.2.10	affected	-
>= 9.3, < 9.3.4	affected	-

Red Hat Enterprise Linux 9

grafana-0:9.2.10-7.el9_3

Fixed · RHSA-2023:6420
OpenShift Service Mesh 2.1

servicemesh-grafana

Not affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/acm-grafana-rhel8

Not affected
Red Hat Ceph Storage 3

grafana

Not affected
Red Hat Ceph Storage 4

rhceph/rhceph-4-dashboard-rhel8

Not affected
Red Hat Ceph Storage 5

rhceph/rhceph-5-dashboard-rhel8

Not affected
Red Hat Enterprise Linux 8

grafana

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-grafana

Not affected
Red Hat Storage 3

grafana

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 9	grafana-0:9.2.10-7.el9_3	Fixed	RHSA-2023:6420
OpenShift Service Mesh 2.1	servicemesh-grafana	Not affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/acm-grafana-rhel8	Not affected	n/a
Red Hat Ceph Storage 3	grafana	Not affected	n/a
Red Hat Ceph Storage 4	rhceph/rhceph-4-dashboard-rhel8	Not affected	n/a
Red Hat Ceph Storage 5	rhceph/rhceph-5-dashboard-rhel8	Not affected	n/a
Red Hat Enterprise Linux 8	grafana	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-grafana	Not affected	n/a
Red Hat Storage 3	grafana	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (11)

https://access.redhat.com/security/cve/CVE-2022-23552
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2158420
Issue Tracking
https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0
x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f
x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a
x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/pull/62143
x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv
x_refsource_CONFIRMThird Party Advisory
https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/
https://nvd.nist.gov/vuln/detail/CVE-2022-23552
https://security.netapp.com/advisory/ntap-20230302-0008/
https://www.cve.org/CVERecord?id=CVE-2022-23552

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-23552		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2158420		Issue Tracking
https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0		x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f		x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a		x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/pull/62143		x_refsource_MISCPatchThird Party Advisory
https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv		x_refsource_CONFIRMThird Party Advisory
https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/
https://nvd.nist.gov/vuln/detail/CVE-2022-23552
https://security.netapp.com/advisory/ntap-20230302-0008/
https://www.cve.org/CVERecord?id=CVE-2022-23552

Change history (3)

Sep 23, 2026, 11:03 PM UTC CISA ADP
- SSVC technical impact changed from total to partial
Sep 22, 2026, 07:27 AM UTC CISA ADP
- SSVC technical impact changed from partial to total
Sep 22, 2026, 07:16 AM UTC CISA ADP
- SSVC technical impact changed from total to partial