Riskcovery

CVE-2023-2801

State
Published
Severity
7.5 High
Published
Jun 6, 2023
Updated
Feb 13, 2025
Reserved
May 18, 2023

Read the record on cve.org

Description

Grafana is an open-source platform for monitoring and observability.

Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.

The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.

This might enable malicious users to crash Grafana instances through that endpoint.

Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HGRAFANA

Weaknesses

Affected Products

ProductVersions
GrafanaGrafana
  • 9.4.0 to before 9.4.12Affected
  • 9.5.0 to before 9.5.3Affected
Grafana EnterpriseGrafana
  • 9.4.0 to before 9.4.12Affected
  • 9.5.0 to before 9.5.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.