CVE-2022-32275 Path traversal in n/a
An attacker could attempt to read arbitrary files via path traversal in Grafana snapshots, though the vendor disputes the vulnerability's validity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-32275?
CVE-2022-32275 is a high-severity path traversal vulnerability in Grafana Grafana, published on 6 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content
Weakness: CWE-22
Which versions are affected by CVE-2022-32275?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 8.4.3 | 8.4.4 |
Products include Grafana Grafana.
How do I fix CVE-2022-32275?
Upgrade grafana to 8.4.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-32275 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32275 exists.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2022-32275, GHSA-vq62-87gp-hrvv.