---
id: CVE-2022-39324
title: Grafana is an open-source platform for monitoring and observability
summary: >-
  Grafana is an open-source platform for monitoring and observability. Prior to
  versions 8.5.16 and 9.2.8, malicious user can create a snapshot and
  arbitrarily choose the `originalUrl` parameter by editing the query, thanks to
  a web proxy.…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L'
cwe:
  - CWE-79
  - CWE-472
vendor: grafana
product: grafana
affected:
  - grafana < 8.5.16
  - 'grafana >= 9.0.0, < 9.2.8'
patched:
  - grafana 9.2.8
published: '2023-01-27'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:11.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-39324'
references:
  - url: >-
      https://github.com/grafana/grafana/commit/239888f22983010576bb3a9135a7294e88c0c74a
    label: security-advisories@github.com
  - url: >-
      https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c
    label: security-advisories@github.com
  - url: 'https://github.com/grafana/grafana/pull/60232'
    label: security-advisories@github.com
  - url: 'https://github.com/grafana/grafana/pull/60256'
    label: security-advisories@github.com
  - url: 'https://github.com/grafana/grafana/security/advisories/GHSA-4724-7jwc-3fpw'
    label: security-advisories@github.com
  - url: >-
      https://github.com/grafana/grafana/commit/239888f22983010576bb3a9135a7294e88c0c74a
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/grafana/grafana/pull/60232'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/grafana/grafana/pull/60256'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/grafana/grafana/security/advisories/GHSA-4724-7jwc-3fpw'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20230309-0010/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-39324.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-39324'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2148252'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-39324'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-39324'
  - url: >-
      https://grafana.com/blog/2023/01/25/grafana-security-releases-new-versions-with-fixes-for-cve-2022-23552-cve-2022-41912-and-cve-2022-39324/
  - url: 'https://access.redhat.com/errata/RHSA-2023:3642'
  - url: 'https://access.redhat.com/errata/RHSA-2023:6420'
  - url: 'https://github.com/grafana/grafana'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - osv
  - go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-28T04:55:23.057324Z'
epss: 0.00828
epssPercentile: 0.57615
aliases:
  - GHSA-4724-7jwc-3fpw
  - BIT-grafana-2022-39324
  - GO-2024-2867
ecosystem: go
ingestedAt: '2026-09-12T03:13:01.751Z'
---

## Overview

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

## Affected

- `grafana < 8.5.16`
- `grafana >= 9.0.0, < 9.2.8`

## Remediation

Upgrade past the affected range:

- `grafana 9.2.8`

## Package advisory (CVE-2022-39324)

Affected packages:

- `github.com/grafana/grafana >= 9.0.0, < 9.2.8`
- `github.com/grafana/grafana < 8.5.16`

Patched in:

- `github.com/grafana/grafana 9.2.8`
- `github.com/grafana/grafana 8.5.16`

Source: https://osv.dev/vulnerability/GHSA-4724-7jwc-3fpw

## Vendor advisories

- **RHSA-2023:3642** · Red Hat · fixed in: Red Hat Ceph Storage 6.1 Tools · released 2023-06-15 · [advisory](https://access.redhat.com/errata/RHSA-2023:3642)
- **RHSA-2023:6420** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2023-11-07 · [advisory](https://access.redhat.com/errata/RHSA-2023:6420)
- **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 2.0, OpenShift Service Mesh 2.1, OpenShift Service Mesh 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 3, Red Hat Ceph Storage 4, … · no fix planned: OpenShift Service Mesh 2.0, Red Hat Ceph Storage 3, Red Hat OpenShift Container Platform 3.11, Red Hat Storage 3, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-39324.json)