Information Disclosure

2023-02-0801:57:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

grafana

vulnerability

data source

query cache

information disclosure

headers

session

attacker

software

0.001 Low

EPSS

Percentile

36.5%

JSON

github.com/grafana/grafana is vulnerable to Information Disclosure. The vulnerability exists when the data source query cache is enabled, Grafana will cache all headers, including the grafana_session, resulting in any user querying a data source which allows an attacker to acquire another user’s session.

CPENameOperatorVersion
github.com/grafana/grafanalev9.2.8
github.com/grafana/grafanalev9.3.2
github.com/grafana/grafanalev9.2.8
github.com/grafana/grafanalev9.3.2