CVE-2023-2801 Vulnerability Details

  /     /     /  

CVE-2023-2801 Metadata Quick Info

CVE Published: 06/06/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: GRAFANA | Vendor: Grafana | Product: Grafana
Status : PUBLISHED

---

CVE-2023-2801 Description

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it\'s also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Metrics

CVSS Version: 3.1 | Base Score: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* NONE
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-820
CWE Name: CWE-820
Source: Grafana

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-26
CAPEC Description: CAPEC-26


Source: NVD (National Vulnerability Database).