Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-2801: Grafana can crash with mixed data source queries
CVE-2023-2801 · published 3 years ago
Summary
Grafana versions that allow public dashboards let users send queries that combine different data sources. A specially crafted mixed query can cause the Grafana server to stop working, potentially disrupting monitoring. Upgrade to Grafana 9.4.12 or 9.5.3 to prevent this issue.
What to do
- Update github.com grafana to version 9.4.12.
- Update github.com grafana to version 9.5.3.
- Update grafana to version 9.5.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | grafana |
< 9.4.12 >= 9.5.0, < 9.5.3 Fix: upgrade to 9.4.12
|
| – | grafana | grafana |
>= 9.4.0, < 9.4.12 >= 9.5.0, < 9.5.3 cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:* |
| Bitnami | – | grafana |
>= 9.5.0, < 9.5.3 Fix: upgrade to 9.5.3
|
Original advisory text
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibili...
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
References
- https://grafana.com/security/security-advisories/cve-2023-2801
- https://security.netapp.com/advisory/ntap-20230706-0002
- https://github.com/advisories/GHSA-x2w4-c67p-g44j
- https://grafana.com/security/security-advisories/cve-2023-2801/ Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-2801 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230706-0002/ Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2801.j... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-662Improper Synchronization
CWE-820Missing Synchronization
Timeline
Published6 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x2w4-c67p-g44j · GHSA
CVE-2023-2801 · NVD
BIT-grafana-2023-2801 · OSV
CVE-2023-2801 · OSV
Track software like this
Free during beta