CVE catalog

CVE-2022-31107

UBUNTU-CVE-2022-31107

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Published: Jul 14, 2022, 12:00:00 AM UTC
Updated: Feb 4, 2026, 4:30:54 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.87% · Oct 25, 2026

This update for grafana fixes the following issues: Updated to version 8.3.10 (jsc#SLE-24565, jsc#SLE-23422, jsc#SLE-23439): - CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535). - CVE-2022-31107: Fixed OAuth account takeover vulnerability (bsc#1201539). - CVE-2022-21702: Fixed XSS through attacker-controlled data source (bsc#1195726). - CVE-2022-21703: Fixed Cross Site Request Forgery (bsc#1195727). - CVE-2022-21713: Fixed Teams API IDOR (bsc#1195728).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Suse	grafana	linux enterprise module for package hub 15 sp4	`8.3.10-150200.3.26.1`	fixed
Opensuse	grafana	leap 15.3	`8.3.10-150200.3.26.1`	fixed
Opensuse	grafana	leap 15.4	`8.3.10-150200.3.26.1`	fixed
Ubuntu	grafana	16.04	`2.6.0+dfsg-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Suse	grafana	rpm	linux enterprise module for package hub 15 sp4	`8.3.10-150200.3.26.1`	Not reported	SUSE-SU-2022:3765-1	Not reported
Opensuse	grafana	rpm	leap 15.3	`8.3.10-150200.3.26.1`	Not reported	SUSE-SU-2022:3765-1	Not reported
Opensuse	grafana	rpm	leap 15.4	`8.3.10-150200.3.26.1`	Not reported	SUSE-SU-2022:3765-1	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 6:27:02 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]