CVE catalog

CVE-2022-31130

UBUNTU-CVE-2022-31130

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Oct 13, 2022, 11:15:00 PM UTC
Updated: Feb 4, 2026, 3:48:17 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.33% · Oct 25, 2026

This update for grafana fixes the following issues: - Version update from 8.5.13 to 8.5.15 (jsc#PED-2617): * CVE-2022-39306: Security fix for privilege escalation (bsc#1205225) * CVE-2022-39307: Omit error from http response when user does not exists (bsc#1205227) * CVE-2022-39201: Do not forward login cookie in outgoing requests (bsc#1204303) * CVE-2022-31130: Make proxy endpoints not leak sensitive HTTP headers (bsc#1204305) * CVE-2022-31123: Fix plugin signature bypass (bsc#1204302) * CVE-2022-39229: Fix blocking other users from signing in (bsc#1204304)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Suse	grafana	linux enterprise module for package hub 15 sp4	`8.5.15-150200.3.32.1`	fixed
Opensuse	grafana	leap 15.4	`8.5.15-150200.3.32.1`	fixed
Ubuntu	grafana	16.04	`2.6.0+dfsg-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Suse	grafana	rpm	linux enterprise module for package hub 15 sp4	`8.5.15-150200.3.32.1`	Not reported	SUSE-SU-2023:0362-1	Not reported
Opensuse	grafana	rpm	leap 15.4	`8.5.15-150200.3.32.1`	Not reported	SUSE-SU-2023:0362-1	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 6:27:06 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]