Description
Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| grafana | grafana | >= 9.2.0, < 9.2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 9.2.0, < 9.2.4 | 9.2.4 | GHSA-vqc4-mpj8-jxch |
| Go | github.com/grafana/grafana | all versions | — | GO-2024-2856 |
Advisories 1
- WID-SEC-2023-0334 Grafana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 23, 2024