Skip to content
OpenAdvisories
High · 7.5 CVE-2023-2801 BIT-grafana-2023-2801EUVD-2023-1909GHSA-x2w4-c67p-g44j

Grafana Missing Synchronization vulnerability

Published Jun 6, 2023 · Updated Feb 13, 2025 · Assigned by GRAFANA

Vendor: Grafana Product: Grafana Product: Grafana Enterprise Package: github.com/grafana/grafana Package: grafana Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open-source platform for monitoring and observability.

Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.

The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.

This might enable malicious users to crash Grafana instances through that endpoint.

Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Affected products

VendorProductAffectedFixed
Grafana Grafana 9.4.0 – < 9.4.12, 9.5.0 – < 9.5.3 9.4.12
Grafana Grafana Enterprise 9.4.0 – < 9.4.12, 9.5.0 – < 9.5.3 9.4.12

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ceph Storage 6 ceph +26 2:17.2.6-167.el9cp RHSA-2023:7740
Red Hat Ceph Storage 6 cephadm-ansible 1:2.18.0-1.el9cp RHSA-2023:7740

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
SLES 15 SP4 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-159000.4.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-159000.4.12.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-159000.6.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 9.5.5-150000.1.51.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2915-1
SUSE Manager Client Tools 15 mgr-push 5.0.1-159000.4.21.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 5.0.1-159000.6.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacecmd 5.0.1-159000.6.42.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacewalk-client-tools 5.0.1-159000.6.48.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 5.0.1-159000.3.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-4.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-4.33.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 9.5.5-1.51.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:2916-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1687520761.cefb248-4.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 mgr-push 5.0.1-4.21.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.24.0-3.6.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-3.6.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 5.0.1-24.30.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 spacecmd 5.0.1-41.42.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 5.0.1-3.33.3 SUSE-SU-2024:0191-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 10.0.1-2.1 openSUSE-SU-2024:13027-1
openSUSE Leap 15.5 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1
openSUSE Leap 15.4 grafana 9.5.5-150200.3.44.1 SUSE-SU-2023:2917-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana < 9.4.12 9.4.12 GHSA-x2w4-c67p-g44j
Go github.com/grafana/grafana >= 9.5.0, < 9.5.3 9.5.3 GHSA-x2w4-c67p-g44j

Advisories 8

References