CVE-2022-23552

21

FAUCET Score

CVE-2022-23552 is a stored Cross-Site Scripting (XSS) vulnerability in Grafana's GeoMap core plugin, affecting versions 8.1 through 8.5.15, 9.0.0 through 9.2.9, and 9.3.0 through 9.3.3. An attacker with Editor privileges can inject malicious JavaScript via unsanitized SVG files, leading to vertical privilege escalation if an administrator views the compromised dashboard. The vulnerability has a CVSS score of 5.4 (Medium) due to its network attack vector, low attack complexity, and requirement for user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 8.1.0, < 8.5.16CPE matchmatch criteria	cpe:2.3:a:grafana:grafana::::::::
		>= 9.0.0, < 9.2.10CPE matchmatch criteria	cpe:2.3:a:grafana:grafana::::::::
		>= 9.3.0, < 9.3.4CPE matchmatch criteria	cpe:2.3:a:grafana:grafana::::::::

CVSS Data

CVSS version used by this source: 3.1

7.3HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Exploitability Score

2.1

Impact Score

5.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.78%

Probability of exploitation in next 30 days

EPSS Percentile

52.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0078 is in the 87th percentile among its peer group of 15,239 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

github_advisorypatch availablevia nvd_reference

nodejspatch availablevia llm_extracted

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: grafana-0:9.2.10-7.el9_3

apollographqlvendor investigatingvia llm_extracted

chainsafevendor investigatingvia llm_extracted

jenkinsvendor investigatingvia llm_extracted

kenticovendor investigatingvia llm_extracted

zimbravendor investigatingvia llm_extracted

Vendor Advisories (7)

redhatCVE-2022-23552Important

grafana: persistent xss in grafana core plugins

zimbrallm-zimbra-cdaaf6de53d404f3HIGH

XSS in ResourcePicker in Grafana

kenticollm-kentico-55c65dd5a30eb7bdHIGH

XSS in ResourcePicker in Grafana

chainsafellm-chainsafe-1da32fd9035deed4HIGH

XSS in ResourcePicker in Grafana

apollographqlllm-apollographql-4bb774ef8272f312HIGH

XSS in ResourcePicker in Grafana

jenkinsllm-jenkins-ef0fa14633dda2deHIGH

XSS in ResourcePicker in Grafana

nodejsllm-nodejs-de5b354266daa87bHIGH

XSS in ResourcePicker in Grafana

References

security.netapp.com / advisory/ntap-20230302-0008

github.com / grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0

PatchThird Party Advisory

github.com / grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f

PatchThird Party Advisory

github.com / grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a

PatchThird Party Advisory

github.com / grafana/grafana/pull/62143

PatchThird Party Advisory

github.com / grafana/grafana/security/advisories/GHSA-8xmm-x63g-f6xv

Third Party Advisory