UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21703

CVE-2022-21703: Grafana Cross Site Request Forgery (CSRF)

Severity
High 8.8
Published
8 Feb 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.5.15, 8.3.5
Also known as
GHSA-cmf4-h3xc-jw8w
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 8.0.0 before 8.3.5
  • From 3.0.1 before 7.5.15
  • Version 3.0.0-beta7
  • Version 3.0.0-beta6
All 9 release lines
  • Version 3.0.0-beta1
  • Version 3.0.0-beta2
  • Version 3.0.0-beta3
  • Version 3.0.0-beta4
  • Version 3.0.0-beta5
  • Version 3.0.0-beta6
  • Version 3.0.0-beta7
  • From 3.0.1 before 7.5.15
  • From 8.0.0 before 8.3.5
GrafanaServers and applications · github:grafana/grafana
  • From 3.0-beta1 before 7.5.15

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21703
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21703
  • GitHub Advisory Database https://github.com/advisories/GHSA-cmf4-h3xc-jw8w
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w