High severity · published Feb 3, 2023
CVE-2022-23498
Grafana is an open-source platform for monitoring and observability
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
8.3.1 before 9.2.10; 9.3.0 before 9.3.4; 8.3.0; 8.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23498
Exploit
https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8
security.netapp.com
https://security.netapp.com/advisory/ntap-20230309-0007/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim