Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
32 vulnerabilities by Grafana Labs
CERTFR-2026-AVI-0359
Vulnerability from certfr_avis - Published: 2026-03-26 - Updated: 2026-03-26
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions antérieures à 11.6.14 | ||
| Grafana Labs | Grafana | Grafana versions 12.3.x antérieures à 12.3.6 | ||
| Grafana Labs | Grafana | Grafana versions 12.2.x antérieures à 12.2.8 | ||
| Grafana Labs | Grafana | Grafana versions 12.1.x antérieures à 12.1.10 | ||
| Grafana Labs | Grafana | Grafana versions 12.4.x antérieures à 12.4.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions ant\u00e9rieures \u00e0 11.6.14",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.3.x ant\u00e9rieures \u00e0 12.3.6",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.2.x ant\u00e9rieures \u00e0 12.2.8",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.1.x ant\u00e9rieures \u00e0 12.1.10",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.4.x ant\u00e9rieures \u00e0 12.4.2",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-27876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27876"
},
{
"name": "CVE-2026-27880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27880"
}
],
"initial_release_date": "2026-03-26T00:00:00",
"last_revision_date": "2026-03-26T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0359",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-26T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2026-27876",
"url": "https://grafana.com/blog/grafana-security-release-critical-and-high-severity-security-fixes-for-cve-2026-27876-and-cve-2026-27880/"
}
]
}
CERTFR-2025-AVI-0597
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | N/A | Grafana versions 11.6.x antérieures à 11.6.3+security-01 | ||
| Grafana Labs | N/A | Grafana versions 11.4.x antérieures à 11.4.6+security-01 | ||
| Grafana Labs | N/A | Grafana versions antérieures à 11.3.8+security-01 | ||
| Grafana Labs | N/A | Grafana versions 12.0.x antérieures à 12.0.2+security-01 | ||
| Grafana Labs | N/A | Grafana versions 11.5.x antérieures à 11.5.6+security-01 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.6.x ant\u00e9rieures \u00e0 11.6.3+security-01",
"product": {
"name": "N/A",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.4.x ant\u00e9rieures \u00e0 11.4.6+security-01",
"product": {
"name": "N/A",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions ant\u00e9rieures \u00e0 11.3.8+security-01",
"product": {
"name": "N/A",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.0.x ant\u00e9rieures \u00e0 12.0.2+security-01",
"product": {
"name": "N/A",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.5.x ant\u00e9rieures \u00e0 11.5.6+security-01",
"product": {
"name": "N/A",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-6023",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6023"
},
{
"name": "CVE-2025-6197",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6197"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0597",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-07-17",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-6197",
"url": "https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/"
}
]
}
CERTFR-2025-AVI-0554
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Grafana Labs. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Synthetic Monitoring Agent | Synthetic Monitoring Agent versions antérieures à 0.38.3 | ||
| Grafana Labs | Greffon Image Renderer | Greffon Image Renderer versions antérieures à 3.12.9 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Synthetic Monitoring Agent versions ant\u00e9rieures \u00e0 0.38.3",
"product": {
"name": "Synthetic Monitoring Agent",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Greffon Image Renderer versions ant\u00e9rieures \u00e0 3.12.9",
"product": {
"name": "Greffon Image Renderer",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-5959",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5959"
},
{
"name": "CVE-2025-6192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6192"
},
{
"name": "CVE-2025-6191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6191"
},
{
"name": "CVE-2025-6554",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6554"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0554",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-07-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Grafana Labs. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-5959",
"url": "https://grafana.com/blog/2025/07/02/grafana-security-update-critical-severity-security-release-for-cve-2025-5959-cve-2025-6554-cve-2025-6191-and-cve-2025-6192-in-grafana-image-renderer-plugin-and-synthetic-monitoring-agent/"
}
]
}
CERTFR-2025-AVI-0515
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.2.x antérieures à 11.2.10 | ||
| Grafana Labs | Grafana | Grafana versions antérieures à 10.4.19 | ||
| Grafana Labs | Grafana | Grafana versions 12.0.x antérieures à 12.0.1 | ||
| Grafana Labs | Grafana | Grafana versions 11.3.x antérieures à 11.3.7 | ||
| Grafana Labs | Grafana | Grafana versions 11.4.x antérieures à 11.4.5 | ||
| Grafana Labs | Grafana | Grafana versions 11.6.x antérieures à 11.6.2 | ||
| Grafana Labs | Grafana | Grafana versions 11.5.x antérieures à 11.5.5 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.2.x ant\u00e9rieures \u00e0 11.2.10 ",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions ant\u00e9rieures \u00e0 10.4.19",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.0.x ant\u00e9rieures \u00e0 12.0.1",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.3.x ant\u00e9rieures \u00e0 11.3.7",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.4.x ant\u00e9rieures \u00e0 11.4.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.6.x ant\u00e9rieures \u00e0 11.6.2",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.5.x ant\u00e9rieures \u00e0 11.5.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-3415",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3415"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0515",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-06-13",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-3415",
"url": "https://grafana.com/blog/2025/06/13/grafana-security-update-medium-severity-security-release-for-cve-2025-3415/"
}
]
}
CERTFR-2025-AVI-0447
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana toutes versions sans les derniers correctifs de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana toutes versions sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-4123",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4123"
},
{
"name": "CVE-2025-3580",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3580"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0447",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-05-23",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-4123",
"url": "https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/"
}
]
}
CERTFR-2025-AVI-0440
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.4.x antérieures à 11.4.4+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.6.x antérieures à 11.6.1+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 12.x antérieures à 12.0.0+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.2.x antérieures à 11.2.9+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.5.x antérieures à 11.5.4+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.3.x antérieures à 11.3.6+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 10.4.x antérieures à 10.4.18+security-01 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.4.x ant\u00e9rieures \u00e0 11.4.4+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.6.x ant\u00e9rieures \u00e0 11.6.1+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 12.x ant\u00e9rieures \u00e0 12.0.0+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.2.x ant\u00e9rieures \u00e0 11.2.9+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.5.x ant\u00e9rieures \u00e0 11.5.4+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.3.x ant\u00e9rieures \u00e0 11.3.6+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.4.x ant\u00e9rieures \u00e0 10.4.18+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-4123",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4123"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0440",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-05-21",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-4123",
"url": "https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/"
}
]
}
CERTFR-2025-AVI-0344
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions antérieures à 10.4.17 sans le dernier correctif de sécurité | ||
| Grafana Labs | Grafana | Grafana versions 11.3.x antérieures à 11.3.5 sans le dernier correctif de sécurité | ||
| Grafana Labs | Grafana | Grafana version 11.6.0 sans le dernier correctif de sécurité | ||
| Grafana Labs | Grafana | Grafana versions 11.2.x antérieures à 11.2.8 sans le dernier correctif de sécurité | ||
| Grafana Labs | Grafana | Grafana versions 11.5.x antérieures à 11.5.3 sans le dernier correctif de sécurité | ||
| Grafana Labs | Grafana | Grafana versions 11.4.x antérieures à 11.4.3 sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions ant\u00e9rieures \u00e0 10.4.17 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.3.x ant\u00e9rieures \u00e0 11.3.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana version 11.6.0 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.2.x ant\u00e9rieures \u00e0 11.2.8 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.5.x ant\u00e9rieures \u00e0 11.5.3 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.4.x ant\u00e9rieures \u00e0 11.4.3 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-3454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3454"
},
{
"name": "CVE-2025-2703",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-2703"
},
{
"name": "CVE-2025-3260",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3260"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0344",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2025-04-22",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2025-3260",
"url": "https://grafana.com/blog/2025/04/22/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-3260-cve-2025-2703-cve-2025-3454/"
}
]
}
CERTFR-2024-AVI-0971
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.x antérieures à 11.2.3+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.3.x antérieures à 11.3.0+security-01 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.x ant\u00e9rieures \u00e0 11.2.3+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.3.x ant\u00e9rieures \u00e0 11.3.0+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-9476",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9476"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0971",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2024-9476",
"url": "https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/"
}
]
}
CERTFR-2024-AVI-0899
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.1.x antérieures à 11.1.6+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.2.x antérieures à 11.2.2+security-01 | ||
| Grafana Labs | Grafana | Grafana versions 11.0.x antérieures à 11.0.5+security-01 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.1.x ant\u00e9rieures \u00e0 11.1.6+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.2.x ant\u00e9rieures \u00e0 11.2.2+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.0.x ant\u00e9rieures \u00e0 11.0.5+security-01",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-9264",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-9264"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0899",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-18T00:00:00.000000"
},
{
"description": "Correction d\u0027une erreur de version",
"revision_date": "2024-10-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": "2024-10-17",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2024-9264",
"url": "https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/"
}
]
}
CERTFR-2024-AVI-0817
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.2.x antérieures à 11.2.1 | ||
| Grafana Labs | Grafana | Grafana versions 11.1.x antérieures à 11.1.6 | ||
| Grafana Labs | Grafana | Grafana versions 10.3.x antérieures à 10.3.10 | ||
| Grafana Labs | Grafana | Grafana versions 10.4.x antérieures à 10.4.9 | ||
| Grafana Labs | Grafana | Grafana versions 11.0.x antérieures à 11.0.5 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.2.x ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.1.x ant\u00e9rieures \u00e0 11.1.6",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.3.x ant\u00e9rieures \u00e0 10.3.10",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.4.x ant\u00e9rieures \u00e0 10.4.9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.0.x ant\u00e9rieures \u00e0 11.0.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-8118",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8118"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0817",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-27T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": "2024-09-26",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2024-8118",
"url": "https://grafana.com/blog/2024/09/26/grafana-security-release-medium-severity-fix-for-cve-2024-8118/"
}
]
}
CERTFR-2024-AVI-0688
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 11.1.x antérieures à 11.1.4 | ||
| Grafana Labs | Grafana | Grafana versions 11.0.x antérieures à 11.0.3 | ||
| Grafana Labs | Grafana | Grafana versions 10.4.x antérieures à 10.4.7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 11.1.x ant\u00e9rieures \u00e0 11.1.4",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 11.0.x ant\u00e9rieures \u00e0 11.0.3",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.4.x ant\u00e9rieures \u00e0 10.4.7",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-6837",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6837"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0688",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-08-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": "2024-08-14",
"title": "Bulletin de s\u00e9curit\u00e9 Grafana cve-2024-6837",
"url": "https://grafana.com/blog/2024/08/14/grafana-security-release-medium-severity-security-fix-for-cve-2024-6837/"
}
]
}
CERTFR-2024-AVI-0193
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 10.1.x antérieures à 10.1.8 | ||
| Grafana Labs | Grafana | Grafana versions antérieures à 9.5.17 | ||
| Grafana Labs | Grafana | Grafana versions 10.0.x antérieures à 10.0.12 | ||
| Grafana Labs | Grafana | Grafana versions 10.2.x antérieures à 10.2.5 | ||
| Grafana Labs | Grafana | Grafana versions 10.3.x antérieures à 10.3.4 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 10.1.x ant\u00e9rieures \u00e0 10.1.8",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions ant\u00e9rieures \u00e0 9.5.17",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.0.x ant\u00e9rieures \u00e0 10.0.12",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.2.x ant\u00e9rieures \u00e0 10.2.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.3.x ant\u00e9rieures \u00e0 10.3.4",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2024-1442",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1442"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0193",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-03-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana du 07 mars 2024",
"url": "https://grafana.com/blog/2024/03/07/grafana-security-release-medium-severity-security-fix-for-cve-2024-1442/"
}
]
}
CERTFR-2024-AVI-0132
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions antérieures à 9.5.16 | ||
| Grafana Labs | Grafana | Grafana versions 10.3.x antérieures à 10.3.3 | ||
| Grafana Labs | Grafana | Grafana versions 10.2.x antérieures à 10.2.4 | ||
| Grafana Labs | Grafana | Grafana versions 10.0.x antérieures à 10.0.11 | ||
| Grafana Labs | Grafana | Grafana versions 10.1.x antérieures à 10.1.7 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions ant\u00e9rieures \u00e0 9.5.16",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.3.x ant\u00e9rieures \u00e0 10.3.3",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.2.x ant\u00e9rieures \u00e0 10.2.4",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.0.x ant\u00e9rieures \u00e0 10.0.11",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.1.x ant\u00e9rieures \u00e0 10.1.7",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-6152",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6152"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0132",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elles permettent \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana du 14 f\u00e9vrier 2024",
"url": "https://grafana.com/blog/2024/02/14/grafana-security-release-medium-severity-security-fix-for-cve-2023-6152/"
}
]
}
CERTFR-2023-AVI-0847
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 8.x à 9.x antérieures à 9.4.17 | ||
| Grafana Labs | Grafana | Grafana versions 10.1.x antérieures à 10.1.5 | ||
| Grafana Labs | Grafana | Grafana versions 10.0.x antérieures à 10.0.9 | ||
| Grafana Labs | Grafana | Grafana versions 9.5.x antérieures à 9.5.13 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 8.x \u00e0 9.x ant\u00e9rieures \u00e0 9.4.17",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.1.x ant\u00e9rieures \u00e0 10.1.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 10.0.x ant\u00e9rieures \u00e0 10.0.9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.5.x ant\u00e9rieures \u00e0 9.5.13",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-4822",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4822"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0847",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-16T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2023-4822 du 13 octobre 2023",
"url": "https://grafana.com/blog/2023/10/13/grafana-security-release-new-versions-of-grafana-with-a-medium-severity-security-fix-for-cve-2023-4822/"
}
]
}
CERTFR-2023-AVI-0497
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 10.0.x antérieures à 10.0.1 | ||
| Grafana Labs | Grafana | Grafana versions 9.3.x antérieures à 9.3.16 | ||
| Grafana Labs | Grafana | Grafana versions 9.x antérieures à 9.2.20 | ||
| Grafana Labs | Grafana | Grafana versions antérieures à 8.5.27 | ||
| Grafana Labs | Grafana | Grafana versions 9.5.x antérieures à 9.5.5 | ||
| Grafana Labs | Grafana | Grafana versions 9.4.x antérieures à 9.4.13 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 10.0.x ant\u00e9rieures \u00e0 10.0.1",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.3.x ant\u00e9rieures \u00e0 9.3.16",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.x ant\u00e9rieures \u00e0 9.2.20",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions ant\u00e9rieures \u00e0 8.5.27",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.4.x ant\u00e9rieures \u00e0 9.4.13",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-3128",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3128"
},
{
"name": "CVE-2023-2801",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2801"
},
{
"name": "CVE-2023-2183",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2183"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0497",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-29T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles\npermettent \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9 et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana du 06 juin 2023",
"url": "https://grafana.com/blog/2023/06/06/grafana-security-release-new-grafana-versions-with-security-fixes-for-cve-2023-2183-and-cve-2023-2801/"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana du 22 juin 2023",
"url": "https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/"
}
]
}
CERTFR-2023-AVI-0257
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 9.3.x antérieures à 9.3.11 | ||
| Grafana Labs | Grafana | Grafana versions 9.4.x antérieures à 9.4.7 | ||
| Grafana Labs | Grafana | Grafana versions 8.5.x antérieures à 8.5.22 | ||
| Grafana Labs | Grafana | Grafana versions 9.2.x antérieures à 9.2.15 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 9.3.x ant\u00e9rieures \u00e0 9.3.11",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.4.x ant\u00e9rieures \u00e0 9.4.7",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 8.5.x ant\u00e9rieures \u00e0 8.5.22",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.2.x ant\u00e9rieures \u00e0 9.2.15",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-1410",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-1410"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0257",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana du 22 mars 2023",
"url": "https://grafana.com/blog/2023/03/22/grafana-security-release-new-versions-with-security-fixes-for-cve-2023-1410/"
}
]
}
CERTFR-2023-AVI-0176
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana 9.2.x et 9.3.x sans le dernier correctif de sécurité |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana 9.2.x et 9.3.x sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-22462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22462"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0176",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-01T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2023-22462 du 01 mars 2023",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-7rqg-hjwc-6mjf"
}
]
}
CERTFR-2023-AVI-0084
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 8.3.0-beta1 à 9.2.x antérieures à 9.2.10 | ||
| Grafana Labs | Grafana | Grafana versions 9.3.x antérieures à 9.3.4 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 8.3.0-beta1 \u00e0 9.2.x ant\u00e9rieures \u00e0 9.2.10",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.3.x ant\u00e9rieures \u00e0 9.3.4",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-23498",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23498"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-23498 du 01 f\u00e9vrier 2023",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8"
}
],
"reference": "CERTFR-2023-AVI-0084",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-23498 du 01 f\u00e9vrier 2023",
"url": null
}
]
}
CERTFR-2023-AVI-0063
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs disponibles (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 9.3.x antérieures à 9.3.2 | ||
| Grafana Labs | Grafana | Grafana versions antérieures à 8.5.16 | ||
| Grafana Labs | Grafana | Grafana versions 9.2.x antérieures à 9.2.8 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 9.3.x ant\u00e9rieures \u00e0 9.3.2",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions ant\u00e9rieures \u00e0 8.5.16",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.2.x ant\u00e9rieures \u00e0 9.2.8",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs disponibles (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-41912",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41912"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0063",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-26T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-5hcf-rqj9-xh96 du 26 janvier 2023",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-5hcf-rqj9-xh96"
}
]
}
CERTFR-2022-AVI-1006
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 9.x antérieures à 9.2.4 | ||
| Grafana Labs | Grafana | Grafana versions 8.x antérieures à 8.5.15 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 9.x ant\u00e9rieures \u00e0 9.2.4",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 8.x ant\u00e9rieures \u00e0 8.5.15",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-39307",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39307"
},
{
"name": "CVE-2022-39306",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39306"
},
{
"name": "CVE-2022-39328",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39328"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-1006",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles\npermettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9\ndes donn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-3p62-42x7-gxg5 du 08 novembre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-3p62-42x7-gxg5"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-vqc4-mpj8-jxch du 08 novembre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-2x6g-h2hg-rq84 du 08 novembre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84"
}
]
}
CERTFR-2022-AVI-914
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 8.5.x antérieures à 8.5.14 | ||
| Grafana Labs | Grafana | Grafana versions 9.1.x antérieures à 9.1.8 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 8.5.x ant\u00e9rieures \u00e0 8.5.14",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.1.x ant\u00e9rieures \u00e0 9.1.8",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-31130",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31130"
},
{
"name": "CVE-2022-39201",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39201"
},
{
"name": "CVE-2022-39229",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39229"
},
{
"name": "CVE-2022-31123",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31123"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-914",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles\npermettent \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-31123 du 12 octobre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-rhxj-gh46-jvw8"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-39229 du 12 octobre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-31130 du 12 octobre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-jv32-5578-pxjc"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-39201 du 12 octobre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-x744-mm8v-vpgr"
}
]
}
CERTFR-2022-AVI-845
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions antérieures à 8.5.13 | ||
| Grafana Labs | Grafana | Grafana versions 9.1.x antérieures à 9.1.6 | ||
| Grafana Labs | Grafana | Grafana versions 9.0.x antérieures à 9.0.9 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions ant\u00e9rieures \u00e0 8.5.13",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.1.x ant\u00e9rieures \u00e0 9.1.6",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.0.x ant\u00e9rieures \u00e0 9.0.9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35957",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35957"
},
{
"name": "CVE-2022-36062",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36062"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-845",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-21T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles\npermettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-ff5c-938w-8c9q du 20 septembre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-p978-56hq-r492 du 20 septembre 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-p978-56hq-r492"
}
]
}
CERTFR-2022-AVI-649
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité, une élévation de privilèges et une injection de code indirecte à distance (XSS).
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 8.4.x antérieures à 8.4.10 | ||
| Grafana Labs | Grafana | Grafana versions 9.0.x antérieures à 9.0.3 | ||
| Grafana Labs | Grafana | Grafana versions 5.3.x à 8.3.x antérieures à 8.3.10 | ||
| Grafana Labs | Grafana | Grafana versions 8.5.x antérieures à 8.5.9 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 8.4.x ant\u00e9rieures \u00e0 8.4.10",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 9.0.x ant\u00e9rieures \u00e0 9.0.3",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 5.3.x \u00e0 8.3.x ant\u00e9rieures \u00e0 8.3.10",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 8.5.x ant\u00e9rieures \u00e0 8.5.9",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-31107",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31107"
},
{
"name": "CVE-2022-31097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31097"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-649",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Grafana. Elles\npermettent \u00e0 un attaquant de provoquer un contournement de la politique\nde s\u00e9curit\u00e9, une \u00e9l\u00e9vation de privil\u00e8ges et une injection de code\nindirecte \u00e0 distance (XSS).\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-mx47-6497-3fv2 du 15 juillet 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana GHSA-vw7q-p2qg-4m5f du 15 juillet 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f"
}
]
}
CERTFR-2022-AVI-507
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Grafana Labs | Grafana | Grafana versions 7.4.x et 7.5.x antérieures à 7.5.16 | ||
| Grafana Labs | Grafana | Grafana versions 8.x antérieures à 8.5.3 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Grafana versions 7.4.x et 7.5.x ant\u00e9rieures \u00e0 7.5.16",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
},
{
"description": "Grafana versions 8.x ant\u00e9rieures \u00e0 8.5.3",
"product": {
"name": "Grafana",
"vendor": {
"name": "Grafana Labs",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-29170",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29170"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Grafana\u00a0CVE-2022-29170 du 19 mai 2022",
"url": "https://github.com/grafana/grafana/security/advisories/GHSA-9rrr-6fq2-4f99"
}
],
"reference": "CERTFR-2022-AVI-507",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-05-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Grafana. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Grafana",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Grafana CVE-2022-29170 du 19 mai 2022",
"url": null
}
]
}
CVE-2025-41116 (GCVE-0-2025-41116)
Vulnerability from cvelistv5 – Published: 2025-11-11 20:18 – Updated: 2025-11-19 17:52
VLAI
Title
Incorrect oauth passthrough in Grafana Databricks Datasource
Summary
When using the Grafana Databricks Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in
the wrong user identifier being used, and information for which the viewer is not authorized being returned.
This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana Databricks Datasource Plugin |
Affected:
1.6.0 , < 1.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T21:44:41.624004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T21:45:13.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Databricks Datasource Plugin",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "1.12.1",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eWhen using the Grafana Databricks Datasource Plugin,\u003cbr\u003eif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u0026nbsp; could result in\u0026nbsp;\u003c/div\u003e\u003cdiv\u003ethe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u0026nbsp;\u003c/div\u003e\u003cp\u003eThis issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "When using the Grafana Databricks Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T17:52:50.180Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2025-41116/"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Incorrect oauth passthrough in Grafana Databricks Datasource",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2025-41116",
"datePublished": "2025-11-11T20:18:07.602Z",
"dateReserved": "2025-04-16T09:19:26.443Z",
"dateUpdated": "2025-11-19T17:52:50.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3717 (GCVE-0-2025-3717)
Vulnerability from cvelistv5 – Published: 2025-11-11 20:17 – Updated: 2025-11-12 21:46
VLAI
Title
Incorrect oauth passthrough in Grafana Snowflake Datasource
Summary
When using the Grafana Snowflake Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in
the wrong user identifier being used, and information for which the viewer is not authorized being returned.
This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana Snowflake Datasource Plugin |
Affected:
1.5.0 , < 1.14.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T21:46:02.961565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T21:46:15.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Snowflake Datasource Plugin",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eWhen using the Grafana Snowflake Datasource Plugin,\u003cbr\u003eif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u0026nbsp; could result in\u0026nbsp;\u003c/div\u003e\u003cdiv\u003ethe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u0026nbsp;\u003c/div\u003e\u003cp\u003eThis issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.\u003c/p\u003e"
}
],
"value": "When using the Grafana Snowflake Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-11T20:17:48.364Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2025-3717/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect oauth passthrough in Grafana Snowflake Datasource",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2025-3717",
"datePublished": "2025-11-11T20:17:48.364Z",
"dateReserved": "2025-04-16T08:56:42.388Z",
"dateUpdated": "2025-11-12T21:46:15.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9476 (GCVE-0-2024-9476)
Vulnerability from cvelistv5 – Published: 2024-11-13 16:30 – Updated: 2025-11-23 15:33
VLAI
Title
Privilege escalation vulnerability for Organizations in Grafana
Summary
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
| https://grafana.com/blog/2024/11/12/grafana-secur… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana OSS and Enterprise |
Affected:
11.3.0 , < 11.3.0+security-01
(semver)
Affected: 11.2.0 , < 11.2.3+security-01 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T15:54:30.628886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T16:13:24.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS and Enterprise",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "11.3.0+security-01",
"status": "affected",
"version": "11.3.0",
"versionType": "semver"
},
{
"lessThan": "11.2.3+security-01",
"status": "affected",
"version": "11.2.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The feature toggle\u0026nbsp;\u003ctt\u003e\u003ccode\u003eonPremToCloudMigrations\u003c/code\u003e\u003c/tt\u003e must be enabled for this vulnerability to be activated. \u003cbr\u003eSee \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://grafana.com/docs/grafana-cloud/account-management/migration-guide/\"\u003ehttps://grafana.com/docs/grafana-cloud/account-management/migration-guide/\u003c/a\u003e for more details\u003cbr\u003e"
}
],
"value": "The feature toggle\u00a0onPremToCloudMigrations must be enabled for this vulnerability to be activated. \nSee https://grafana.com/docs/grafana-cloud/account-management/migration-guide/ for more details"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.\u003cdiv\u003e\u003cdiv\u003eThis vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-23T15:33:38.284Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2024-9476/"
},
{
"url": "https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege escalation vulnerability for Organizations in Grafana",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2024-9476",
"datePublished": "2024-11-13T16:30:54.581Z",
"dateReserved": "2024-10-03T12:58:42.842Z",
"dateUpdated": "2025-11-23T15:33:38.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-41116 (GCVE-0-2025-41116)
Vulnerability from nvd – Published: 2025-11-11 20:18 – Updated: 2025-11-19 17:52
VLAI
Title
Incorrect oauth passthrough in Grafana Databricks Datasource
Summary
When using the Grafana Databricks Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in
the wrong user identifier being used, and information for which the viewer is not authorized being returned.
This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana Databricks Datasource Plugin |
Affected:
1.6.0 , < 1.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T21:44:41.624004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T21:45:13.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Databricks Datasource Plugin",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "1.12.1",
"status": "affected",
"version": "1.6.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eWhen using the Grafana Databricks Datasource Plugin,\u003cbr\u003eif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u0026nbsp; could result in\u0026nbsp;\u003c/div\u003e\u003cdiv\u003ethe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u0026nbsp;\u003c/div\u003e\u003cp\u003eThis issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "When using the Grafana Databricks Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T17:52:50.180Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2025-41116/"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Incorrect oauth passthrough in Grafana Databricks Datasource",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2025-41116",
"datePublished": "2025-11-11T20:18:07.602Z",
"dateReserved": "2025-04-16T09:19:26.443Z",
"dateUpdated": "2025-11-19T17:52:50.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3717 (GCVE-0-2025-3717)
Vulnerability from nvd – Published: 2025-11-11 20:17 – Updated: 2025-11-12 21:46
VLAI
Title
Incorrect oauth passthrough in Grafana Snowflake Datasource
Summary
When using the Grafana Snowflake Datasource Plugin,
if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in
the wrong user identifier being used, and information for which the viewer is not authorized being returned.
This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana Snowflake Datasource Plugin |
Affected:
1.5.0 , < 1.14.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-12T21:46:02.961565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T21:46:15.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana Snowflake Datasource Plugin",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eWhen using the Grafana Snowflake Datasource Plugin,\u003cbr\u003eif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u0026nbsp; could result in\u0026nbsp;\u003c/div\u003e\u003cdiv\u003ethe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u0026nbsp;\u003c/div\u003e\u003cp\u003eThis issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.\u003c/p\u003e"
}
],
"value": "When using the Grafana Snowflake Datasource Plugin,\nif Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it\u00a0 could result in\u00a0\n\nthe wrong user identifier being used, and information for which the viewer is not authorized being returned.\u00a0\n\nThis issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-11T20:17:48.364Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"url": "https://grafana.com/security/security-advisories/cve-2025-3717/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect oauth passthrough in Grafana Snowflake Datasource",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2025-3717",
"datePublished": "2025-11-11T20:17:48.364Z",
"dateReserved": "2025-04-16T08:56:42.388Z",
"dateUpdated": "2025-11-12T21:46:15.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9476 (GCVE-0-2024-9476)
Vulnerability from nvd – Published: 2024-11-13 16:30 – Updated: 2025-11-23 15:33
VLAI
Title
Privilege escalation vulnerability for Organizations in Grafana
Summary
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://grafana.com/security/security-advisories/… | vendor-advisory |
| https://grafana.com/blog/2024/11/12/grafana-secur… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Grafana Labs | Grafana OSS and Enterprise |
Affected:
11.3.0 , < 11.3.0+security-01
(semver)
Affected: 11.2.0 , < 11.2.3+security-01 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T15:54:30.628886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T16:13:24.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Grafana OSS and Enterprise",
"vendor": "Grafana Labs",
"versions": [
{
"lessThan": "11.3.0+security-01",
"status": "affected",
"version": "11.3.0",
"versionType": "semver"
},
{
"lessThan": "11.2.3+security-01",
"status": "affected",
"version": "11.2.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The feature toggle\u0026nbsp;\u003ctt\u003e\u003ccode\u003eonPremToCloudMigrations\u003c/code\u003e\u003c/tt\u003e must be enabled for this vulnerability to be activated. \u003cbr\u003eSee \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://grafana.com/docs/grafana-cloud/account-management/migration-guide/\"\u003ehttps://grafana.com/docs/grafana-cloud/account-management/migration-guide/\u003c/a\u003e for more details\u003cbr\u003e"
}
],
"value": "The feature toggle\u00a0onPremToCloudMigrations must be enabled for this vulnerability to be activated. \nSee https://grafana.com/docs/grafana-cloud/account-management/migration-guide/ for more details"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.\u003cdiv\u003e\u003cdiv\u003eThis vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-23T15:33:38.284Z",
"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"shortName": "GRAFANA"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://grafana.com/security/security-advisories/cve-2024-9476/"
},
{
"url": "https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Privilege escalation vulnerability for Organizations in Grafana",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
"assignerShortName": "GRAFANA",
"cveId": "CVE-2024-9476",
"datePublished": "2024-11-13T16:30:54.581Z",
"dateReserved": "2024-10-03T12:58:42.842Z",
"dateUpdated": "2025-11-23T15:33:38.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}