Description
Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.
Grafana Cloud instances have already been patched and an audit did not find any usage of this attack vector. Grafana Enterprise customers were provided with updated binaries under embargo.
Recommendation
Update the @grafana/data package to the latest compatible version. Followings are version details:
- Affected version(s): >= 8.0.0, < 8.2.3
- Patched version(s): 8.2.3
References
Could your website be exposed too?
SmartScanner can check your website for XSS vulnerability allowing arbitrary JavaScript execution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Widget feature vulnerability allowing to execute JavaScript code using undo functionality - CVE-2021-32808
- Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality - CVE-2021-32809
- Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML - CVE-2021-41164
- Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML. - CVE-2021-37695
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023