CVE-2023-2801

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 9.4.12 Grafana versions prior to 9.5.3

Description Grafana is an open-source platform for monitoring and observability. Using public dashboards, users can query multiple distinct data sources using mixed queries. However, such a query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint.

Recommendations For versions prior to 9.4.12, upgrade to version 9.4.12 to receive a fix. For versions prior to 9.5.3, upgrade to version 9.5.3 to receive a fix. As a temporary workaround, consider restricting access to the query API endpoint to minimize the risk of exploitation.