Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ceph-fuse-debuginfoUpgrade ceph-commonUpgrade librgw-develUpgrade python3-ceph-argparseUpgrade ceph-debuginfoUpgrade python3-ceph-commonUpgrade python3-rados-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade librgw2Upgrade ceph-immutable-object-cacheUpgrade libcephfs-develUpgrade librados-devel-debuginfoUpgrade librgw2-debuginfoUpgrade python3-cephfsUpgrade libcephfs2-debuginfoUpgrade python3-radosUpgrade libcephsqlite-debuginfoUpgrade python3-rbdUpgrade cephadmUpgrade libradosstriper1-debuginfoUpgrade rbd-nbdUpgrade librados-develUpgrade librbd-develUpgrade ceph-fuseUpgrade libcephfs2Upgrade libradospp-develUpgrade ceph-test-debuginfoUpgrade rbd-nbd-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-selinuxUpgrade ceph-base-debuginfoUpgrade ceph-mon-debuginfoUpgrade python3-rgwUpgrade ceph-mds-debuginfoUpgrade python3-rbd-debuginfoUpgrade ceph-exporter-debuginfoUpgrade libradosstriper1Upgrade python3-cephfs-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-debugsourceUpgrade ceph-common-debuginfoUpgrade cephfs-topUpgrade python3-rgw-debuginfoUpgrade ceph-resource-agentsUpgrade ceph-mgr-debuginfoUpgrade ceph-baseUpgrade ceph-radosgw-debuginfoUpgrade rbd-mirror-debuginfoUpgrade cephadm-ansibleUpgrade ceph-mib | Dec 13, 2023 | Jun 6, 2023 |
| Freebsd | — | Upgrade grafana9Upgrade grafana | Jun 8, 2023 | Jun 7, 2023 |
| Redhat_linux | — | Upgrade ceph-commonUpgrade ceph-common-debuginfoUpgrade librbd-develUpgrade python3-rbdUpgrade libradosstriper1-debuginfoNo solution existsUpgrade libradospp-develUpgrade librados-devel-debuginfoUpgrade ceph-selinuxUpgrade ceph-baseUpgrade libcephfs-develUpgrade python3-rados-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade rbd-nbdUpgrade ceph-fuse-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-mibUpgrade cephadmUpgrade libradosstriper1Upgrade cephfs-topUpgrade ceph-osd-debuginfoUpgrade ceph-resource-agentsUpgrade python3-rbd-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-immutable-object-cacheUpgrade libcephsqlite-debuginfoUpgrade ceph-fuseUpgrade librgw2-debuginfoUpgrade ceph-debuginfoUpgrade cephadm-ansibleUpgrade ceph-test-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-debugsourceUpgrade ceph-immutable-object-cache-debuginfoUpgrade librados-develUpgrade ceph-mon-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade python3-rgwUpgrade python3-ceph-commonUpgrade libcephfs2-debuginfoUpgrade librgw2Upgrade ceph-exporter-debuginfoUpgrade ceph-base-debuginfoUpgrade libcephfs2Upgrade rbd-fuse-debuginfoUpgrade librgw-develUpgrade python3-cephfsUpgrade rbd-nbd-debuginfoUpgrade python3-cephfs-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python3-radosUpgrade ceph-mgr-debuginfo | Dec 13, 2023 | Jun 6, 2023 |
| Suse | — | Upgrade grafana | Jul 21, 2023 | Jun 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub