CVE-2022-32275
Published: 06 June 2022
Summary
CVE-2022-32275 is a high-severity Path Traversal (CWE-22) vulnerability in Grafana Grafana. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-32275 is a path traversal vulnerability, tracked under CWE-22, that affects Grafana version 8.4.3. The flaw permits an attacker to supply a specially crafted URI such as /dashboard/snapshot/%7B%7Bconstructor.constructor'/../../../../../../../../etc/passwd that traverses directories and attempts to retrieve arbitrary files from the underlying system. The issue carries a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can exploit the condition simply by sending an HTTP request containing the malicious path. Successful traversal would expose sensitive files on the Grafana host, resulting in high-impact confidentiality loss while leaving integrity and availability unaffected.
Vendor statements in the referenced GitHub issues and Grafana site maintain that the observed behavior produces only a benign error page rather than actual file contents, and therefore no vulnerability or patch is acknowledged. The associated EPSS score has remained stable near its peak value of 0.6738 with no material upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53472
Vulnerability details
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.