CVE-2023-2801
published 2023-06-06CVE-2023-2801: Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed…
PriorityP428medium5.3CVSS 3.1
AVNACHPRLUINSUCNINAH
EPSS
0.74%
50.1th percentile
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | grafana_grafana | >= 0 < 9.4.12 | 9.4.12 |
| github.com | grafana_grafana | >= 9.5.0 < 9.5.3 | 9.5.3 |
| grafana | grafana | >= 9.4.0 < 9.4.12 | 9.4.12 |
| grafana | grafana | >= 9.5.0 < 9.5.3 | 9.5.3 |
| grafana | grafana_enterprise | >= 9.4.0 < 9.4.12 | 9.4.12 |
| grafana | grafana_enterprise | >= 9.5.0 < 9.5.3 | 9.5.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.3MEDIUM
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-2801: Grafana is an open-source platform for monitoring and observability
osv·2023-06-06·CVSS 5.3
CVE-2023-2801 [MEDIUM] CVE-2023-2801: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
OSV
Grafana Missing Synchronization vulnerability
osv·2023-06-06
CVE-2023-2801 [HIGH] Grafana Missing Synchronization vulnerability
Grafana Missing Synchronization vulnerability
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
GHSA
Grafana Missing Synchronization vulnerability
ghsa·2023-06-06
CVE-2023-2801 [HIGH] CWE-662 Grafana Missing Synchronization vulnerability
Grafana Missing Synchronization vulnerability
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
Red Hat
grafana: data source proxy race condition
vendor_redhat·2023-06-06·CVSS 7.5
CVE-2023-2801 [HIGH] CWE-820 grafana: data source proxy race condition
grafana: data source proxy race condition
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
A flaw was found in grafana. This issue occurs when sending an API call to the /ds/query or public dashboard query endpoint that has mixed queries, such as having two or more distinct data sources in one API call. As a result, th
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-06
Published