Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins | Grafana Labs

Products Open source Solutions Learn Docs Company

Downloads Contact us Sign in

Create free account Contact us

Products

Core LGTM Stack

Logs

powered by Grafana Loki

Grafana

for visualization

Traces

powered by Grafana Tempo

Metrics

powered by Grafana Mimir and Prometheus

extend observability

Performance & load testing

powered by Grafana k6

Continuous profiling

powered by Grafana Pyroscope

Plugins

Connect Grafana to data sources, apps, and more

end-to-end solutions

Application Observability

Monitor application performance

Frontend Observability

Gain real user monitoring insights

Incident Response & Management

with Grafana Alerting, Grafana Incident, Grafana OnCall, and Grafana SLO

Deploy The Stack

Grafana Cloud

Fully managed

Grafana Enterprise

Self-managed

Pricing

Hint: It starts at FREE

Open Source

Grafana Loki

Multi-tenant log aggregation system

Grafana

Query, visualize, and alert on data

Grafana Tempo

High-scale distributed tracing backend

Grafana Mimir

Scalable and performant metrics backend

Grafana OnCall

On-call management

Grafana Pyroscope

Scalable continuous profiling backend

Grafana Beyla

eBPF auto-instrumentation

Grafana Faro

Frontend application observability web SDK

Grafana Alloy

OpenTelemetry Collector distribution with Prometheus pipelines

Grafana k6

Load testing for engineering teams

Prometheus

Monitor Kubernetes and cloud native

OpenTelemetry

Instrument and collect telemetry data

Graphite

Scalable monitoring for time series data

Community resources

Dashboard templates

Try out and share prebuilt visualizations

Prometheus exporters

Get your metrics into Prometheus quickly

end-to-end solutions

Opinionated solutions that help you get there easier and faster

Kubernetes Monitoring

Get K8s health, performance, and cost monitoring from cluster to container

Application Observability

Monitor application performance

Frontend Observability

Gain real user monitoring insights

Incident Response & Management

Detect and respond to incidents with a simplified workflow

monitor infrastructure

Out-of-the-box KPIs, dashboards, and alerts for observability

visualize any data

Instantly connect all your data sources to Grafana

Learn

Stay up to date

GrafanaCON 2024

Our biggest community event

ObservabilityCON on the Road 2024

Open source observability conference

Story of Grafana

10 years of Grafana

Observability Survey 2024

Key findings and results

New

Blog

News, releases, cool stories, and more

Events

Upcoming in-person and virtual events

Success stories

By use case, product, and industry

Technical learning

Documentation

All the docs

Webinars and videos

Demos, webinars, and feature tours

Tutorials

Step-by-step guides

Workshops

Free, in-person or online

Writers' Toolkit

Contribute to technical documentation provided by Grafana Labs

Plugin development

Visit the Grafana developer portal for tools and resources for extending Grafana with plugins.

new

Join the community

Community

Join the Grafana community

new

Community forums

Ask the community for help

Community Slack

Real-time engagement

Grafana Champions

Contribute to the community

new

Community organizers

Host local meetups

new

Company

Careers We're hiring

Core LGTM Stack

Logs

powered by Grafana Loki

Grafana

for visualization

Traces

powered by Grafana Tempo

Metrics

powered by Grafana Mimir and Prometheus

extend observability

Performance & load testing

powered by Grafana k6

Continuous profiling

powered by Grafana Pyroscope

Plugins

Connect Grafana to data sources, apps, and more

end-to-end solutions

Application Observability

Monitor application performance

Frontend Observability

Gain real user monitoring insights

Incident Response & Management

with Grafana Alerting, Grafana Incident, Grafana OnCall, and Grafana SLO

Deploy The Stack

Grafana Cloud

Fully managed

Grafana Enterprise

Self-managed

Pricing

Hint: It starts at FREE

Grafana Cloud

Free forever plan

(Surprise: it’s actually useful)

Grafana, of course
14 day retention
10k series Prometheus metrics
500 VUh k6 testing
50 GB logs, traces, and profiles
50k frontend sessions
and more cool stuff

Create free account

No credit card needed, ever.

Grafana Loki

Multi-tenant log aggregation system

Grafana

Query, visualize, and alert on data

Grafana Tempo

High-scale distributed tracing backend

Grafana Mimir

Scalable and performant metrics backend

Grafana OnCall

On-call management

Grafana Pyroscope

Scalable continuous profiling backend

Grafana Beyla

eBPF auto-instrumentation

Grafana Faro

Frontend application observability web SDK

Grafana Alloy

OpenTelemetry Collector distribution with Prometheus pipelines

Grafana k6

Load testing for engineering teams

Prometheus

Monitor Kubernetes and cloud native

OpenTelemetry

Instrument and collect telemetry data

Graphite

Scalable monitoring for time series data

Community resources

Dashboard templates

Try out and share prebuilt visualizations

Prometheus exporters

Get your metrics into Prometheus quickly

end-to-end solutions

Opinionated solutions that help you get there easier and faster

Kubernetes Monitoring

Get K8s health, performance, and cost monitoring from cluster to container

Application Observability

Monitor application performance

Frontend Observability

Gain real user monitoring insights

Incident Response & Management

Detect and respond to incidents with a simplified workflow

monitor infrastructure

Out-of-the-box KPIs, dashboards, and alerts for observability

visualize any data

Instantly connect all your data sources to Grafana

All monitoring and visualization solutions

Stay up to date

GrafanaCON 2024

Our biggest community event

ObservabilityCON on the Road 2024

Open source observability conference

Story of Grafana

10 years of Grafana

Observability Survey 2024

Key findings and results

New

Blog

News, releases, cool stories, and more

Events

Upcoming in-person and virtual events

Success stories

By use case, product, and industry

Technical learning

Documentation

All the docs

Webinars and videos

Demos, webinars, and feature tours

Tutorials

Step-by-step guides

Workshops

Free, in-person or online

Writers' Toolkit

Contribute to technical documentation provided by Grafana Labs

Plugin development

Visit the Grafana developer portal for tools and resources for extending Grafana with plugins.

new

Join the community

Community

Join the Grafana community

new

Community forums

Ask the community for help

Community Slack

Real-time engagement

Grafana Champions

Contribute to the community

new

Community organizers

Host local meetups

new

Featured

Getting started with grafana LGTM stack

Getting started with the Grafana LGTM Stack

We’ll demo how to get started using the LGTM Stack: Loki for logs, Grafana for visualization, Tempo for traces, and Mimir for metrics.

Careers We're hiring

Grot cannot remember your choice unless you click the consent notice at the bottom.

CVE ID: CVE-2022-39201

Date Published: October 12, 2022

Description:

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user’s Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.