Medium severity · published Jun 6, 2023
CVE-2023-2801
Grafana is an open-source platform for monitoring and observability
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
9.4.0 before 9.4.12; 9.5.0 before 9.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2801
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2801
Vendor Advisory
https://grafana.com/security/security-advisories/cve-2023-2801/
security.netapp.com
https://security.netapp.com/advisory/ntap-20230706-0002/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim