Security readout for executives and security teams
Plain-English summary
A trusted Grafana editor could plant a malicious SVG in a GeoMap panel. If an admin later views the dashboard, script runs as that admin and can compromise admin-level actions, including the password-change scenario described by Grafana. This is serious for shared Grafana instances with broad editor access.
Executive priority
Treat as high priority where Grafana is shared across teams or administrators routinely view user-edited dashboards. The required Editor access limits broad external exploitation, but the potential impact includes admin-context actions and credential compromise.
Technical view
CVE-2022-23552 is stored XSS in Grafana's core GeoMap FileUploader. SVG content was not properly sanitized, allowing JavaScript execution in the viewer's authenticated context. Exploitation requires Editor privileges and user interaction from a dashboard viewer. Fixed releases are 8.5.16, 9.2.10, and 9.3.4.
Likely exposure
Exposure applies to Grafana versions >=8.1 and <8.5.16, >=9.0 and <9.2.10, and >=9.3 and <9.3.4. Risk is most relevant where non-admin users have Editor roles and administrators view shared dashboards.
Exploitation context
The supplied sources do not show known active exploitation, and this CVE is not marked KEV. The attack path requires an authenticated Editor to alter a panel and a higher-privileged user to view the affected dashboard.
Researcher notes
The issue maps to CWE-79 with CVSS 3.1 score 7.3, vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. Evidence supports stored XSS and vertical privilege escalation risk, but not unauthenticated exploitation or active exploitation.
Mitigation direction
- Upgrade Grafana to 8.5.16, 9.2.10, 9.3.4, or later supported versions.
- Review Grafana Editor role assignments and reduce unnecessary dashboard modification privileges.
- Check Grafana and downstream vendor advisories for environment-specific remediation guidance.
- Prioritize shared or internet-accessible Grafana instances with multiple user roles.
Validation and detection
- Inventory Grafana versions across production, staging, and managed appliances.
- Confirm no instance runs the affected version ranges listed in the advisory.
- Review dashboards using GeoMap panels for recent unexpected edits by Editor accounts.
- Check audit or access logs for suspicious dashboard changes before upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-23552 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N2.15.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xvCVE reference · x_refsource_CONFIRM
- https://github.com/grafana/grafana/pull/62143CVE reference · x_refsource_MISC
- https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0CVE reference · x_refsource_MISC
- https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5fCVE reference · x_refsource_MISC
- https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400aCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20230302-0008/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.