CVE-2022-23498 When query caching is enabled in Grafana users can query another users session

2023-02-0321:34:58

CWE-200

GitHub_M

www.cve.org

grafana

query caching

session access

vulnerability

patch

version 9.2.10

version 9.3.4

7.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.7%

JSON

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafana_session. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.

CNA Affected

[
  {
    "vendor": "grafana",
    "product": "grafana",
    "versions": [
      {
        "version": ">= 8.3.0-beta1, < 9.2.10",
        "status": "affected"
      }
    ]
  }
]