CVE-2022-31176CWE-200

Grafana Image Renderer leaking files

High · published September 2, 2022

CVSS v3.1
8.3
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome). An internal security review identified an unauthorized file disclosure vulnerability. It is possible for a malicious user to retrieve unauthorized files under some network conditions or via a fake datasource (if user has admin permissions in Grafana). All Grafana installations should be upgraded to version 3.6.1 as soon as possible. As a workaround it is possible to [disable HTTP remote rendering](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#plugingrafana-image-renderer).

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01114 · 65.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-09-02T00:00Z
EPSS history
Timeline
  • 02 SEP 00:00Z
    Grafana Image Renderer leaking files
    cvelistv5