CVE-2023-2801

Katalog CVE

CVSS 5.3 · Medium EPSS 0,75%

Kerentanan Missing Synchronization pada grafana. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Rincian

Terbit di NVD

6 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-820: Missing Synchronization
CWE-662: Improper Synchronization

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://grafana.com/security/security-advisories/cve-2023-2801/ advisory vendor
• https://security.netapp.com/advisory/ntap-20230706-0002/