CVE-2022-39201

Name of the Vulnerable Software and Affected Versions Grafana versions 5.0.0-beta1 through 8.5.13 Grafana versions 9.0.0 through 9.1.7

Description The issue is related to the transmission of user authentication cookies to plugins, potentially allowing a remote attacker to disclose protected information. This affects data source and plugin proxy endpoints under certain conditions, where the destination plugin could receive a user's Grafana authentication cookie.

Recommendations For Grafana versions 5.0.0-beta1 through 8.5.13, update to version 8.5.14 to resolve the issue. For Grafana versions 9.0.0 through 9.1.7, update to version 9.1.8 to resolve the issue. As a temporary workaround, consider restricting access to data source and plugin proxy endpoints to minimize the risk of exploitation.