GitHub Advisoryadvisory · Go

GHSA-x2w4-c67p-g44j Grafana Missing Synchronization vulnerability

HIGH Published 2023-06-06 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-2801
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-662, CWE-820
Reviewed
2023-06-07

Affected packages

• Go github.com/grafana/grafana: < 9.4.12 → fixed in 9.4.12 • Go github.com/grafana/grafana: >= 9.5.0, < 9.5.3 → fixed in 9.5.3

Description

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Related

Alias · CVE (1)

  • CVE-2023-2801 Grafana is an open-source platform for monitoring and observability. vulnerability

Weakness · CWE (2)

  • CWE-662 Improper Synchronization weakness
  • CWE-820 Missing Synchronization weakness

References