p PatchFirst

CVE-2022-31123

CVE-2022-31123 · Grafana plugin signature bypass vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.

CVSS 6.1 · Medium · EPSS 0.3%

Published
Updated

Stack: system · applications

Affected products and versions

  • grafana

    Versions
    • < 8.5.14: Affected
    • >= 9.0.0, < 9.1.8: Affected

    No fix published

  • grafana Ubuntu:16.04:LTS

    Versions
    • 2.6.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →