Detections
Analytics

SCA: security update for github.com/grafana/grafana (GHSA-xc3p-28hw-q24g)

medium Tenable Cloud Security Plugin ID 433951

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Grafana is an open-source platform for monitoring and observability. In affected versions an attacker
 could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML
 page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could
 either compromise an existing datasource for a specific Grafana instance or either set up its own public
 service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following
 must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as
 Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above
 datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked
 on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled
 with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a
 specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated
 user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a
 compromised plugin through a crafted link. Users are advised to update to a patched version. There are no
 known workarounds for this vulnerability. (CVE-2022-21702)

See Also

https://github.com/advisories/GHSA-xc3p-28hw-q24g

Plugin Details

Severity: Medium

ID: 433951

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.4

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:N/I:P/A:N

CVSS Score Source: CVE-2022-21702

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/14/2024

Vulnerability Publication Date: 2/8/2022

Reference Information

CVE: CVE-2022-21702

cwe: CWE-79