漏洞描述
Grafana是一个跨平台、开源的数据可视化网络应用程序平台。用户配置连接的数据源之后，Grafana可以在网络浏览器里显示数据图表和警告。CVE-2022-31107 中在Grafana开启了OAuth的情况下，攻击者可能可利用OAuth Provider 的注册功能并最终实现账号劫持。
Grafana OAuth 账号劫持漏洞
PoC代码
暂无相关漏洞推荐
- Grafana存在重定向漏洞(CVE-2025-4123)
- Grafana /avatar 服务器端请求伪造漏洞（CVE-2020-13379）
- POC CVE-2019-15043: Grafana - Improper Access Control
- POC CVE-2020-11110: Grafana <= 6.7.1 - Cross-Site Scripting
- POC CVE-2020-13379: Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
- POC CVE-2021-27358: Grafana Unauthenticated Snapshot Creation
- POC CVE-2021-39226: Grafana Snapshot - Authentication Bypass
- POC CVE-2021-41174: Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
- POC CVE-2021-43798: Grafana v8.x - Arbitrary File Read
- POC CVE-2022-26148: Grafana & Zabbix Integration - Credentials Disclosure
- POC CVE-2024-9264: Grafana Post-Auth DuckDB - SQL Injection To File Read
- POC CVE-2025-3415: Grafana - Exposes DingDing API Keys
- POC CVE-2025-4123: Grafana - XSS / Open Redirect / SSRF via Client Path Traversal