Skip to content
Fencer Vulns
high 7.5

CVE-2023-2801 json

Grafana Missing Synchronization vulnerability

published 2023-06-06 3 y ago modified 2026-09-10 59 d ago also BIT-grafana-2023-2801 , EUVD-2023-1909 , GHSA-x2w4-c67p-g44j

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

Grafana is an open-source platform for monitoring and observability.

Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.

The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.

This might enable malicious users to crash Grafana instances through that endpoint.

Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Patch / fix

  • go github.com/grafana/grafana 9.4.12, 9.5.3
  • bitnami grafana 9.4.12, 9.5.3
  • Grafana Grafana 9.4.12, 9.5.3
  • Grafana Grafana Enterprise 9.4.12, 9.5.3
  • ceph ceph storage 6.1 2:17.2.6-167.el9cp
  • cephadm ceph storage 6.1 2:17.2.6-167.el9cp
  • librbd1 ceph storage 6.1 2:17.2.6-167.el9cp
  • librgw2 ceph storage 6.1 2:17.2.6-167.el9cp
  • rbd-nbd ceph storage 6.1 2:17.2.6-167.el9cp
  • ceph-mib ceph storage 6.1 2:17.2.6-167.el9cp
  • ceph-base ceph storage 6.1 2:17.2.6-167.el9cp
  • ceph-fuse ceph storage 6.1 2:17.2.6-167.el9cp

red hat advisories RHSA-2023:7740

  • rhnlib Manager Client Tools 15-BETA 5.0.1-159000.6.30.1
  • ansible Manager Client Tools 15-BETA 2.9.27-159000.3.9.1
  • grafana Manager Client Tools 15-BETA 9.5.8-159000.4.24.1
  • mgr-push Manager Client Tools 15-BETA 5.0.1-159000.4.21.1
  • spacecmd Manager Client Tools 15-BETA 5.0.1-159000.6.42.1
  • python-hwdata Manager Client Tools 15-BETA 2.3.5-159000.5.13.1
  • python-pyvmomi Manager Client Tools 15-BETA 6.7.3-159000.3.6.1
  • dracut-saltboot Manager Client Tools Beta for SLE Micro 5, Manager Client Tools 15-BETA 0.1.1681904360.84ef141-159000.3.30.1

suse advisories SUSE-SU-2024:0196-1SUSE-SU-2024:0191-1SUSE-SU-2023:2917-1SUSE-SU-2023:2916-1SUSE-SU-2023:2915-1

  • grafana openSUSE Tumbleweed 10.0.1-2.1

opensuse advisories openSUSE-SU-2024:13027-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-2801 updated cvss 7.5

grafana: data source proxy race condition

  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana Red Hat Ceph Storage 3 grafana
    affected: workaround, no fix planned “Block mixed query requests and patch to disable mixed query concurrent calls”
  • Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix available “Block mixed query requests and patch to disable mixed query concurrent calls”
  • Red Hat Enterprise Linux 9 grafana, grafana-selinux
    affected: workaround, no fix planned “Block mixed query requests and patch to disable mixed query concurrent calls”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-grafana
    affected: workaround, no fix available “Block mixed query requests and patch to disable mixed query concurrent calls”
  • Red Hat Storage 3 grafana
    affected: workaround, no fix planned “Block mixed query requests and patch to disable mixed query concurrent calls”
  • Red Hat Ceph Storage 6.1 Tools ceph 17.2.6-167.el9cp, cephadm 17.2.6-167.el9cp, librbd1 17.2.6-167.el9cp, librgw2 17.2.6-167.el9cp, rbd-nbd 17.2.6-167.el9cp, ceph-mib 17.2.6-167.el9cp, +18 more
    fixed: vendor fix “Block mixed query requests and patch to disable mixed query concurrent calls” RHSA-2023:7740
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel8 Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-263, rhceph/keepalived-rhel9 2.2.8-4, rhceph/snmp-notifier-rhel9 1.2.1-48, rhceph/rhceph-haproxy-rhel9 2.4.22-5, rhceph/rhceph-promtail-rhel9 v2.4.0-12 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
22 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/grafana/grafana
<9.4.12
>=9.5.0, <9.5.3
9.4.12
9.5.3
bitnami grafana
>=9.4.0, <9.4.12
>=9.5.0, <9.5.3
9.4.12
9.5.3

Affected products

  • Grafana Grafana
  • Grafana Grafana Enterprise

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.