Grafana is an open-source platform for monitoring and observability.
Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.
The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.
This might enable malicious users to crash Grafana instances through that endpoint.
Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcephfs-develUpgrade libcephsqlite-debuginfoUpgrade libcephfs2-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade librgw2Upgrade ceph-commonUpgrade ceph-debuginfoUpgrade python3-ceph-commonUpgrade python3-rados-debuginfoUpgrade rbd-nbdUpgrade librbd-develUpgrade libradosstriper1-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-fuseUpgrade librgw2-debuginfoUpgrade librados-devel-debuginfoUpgrade cephadmUpgrade librgw-develUpgrade python3-radosUpgrade python3-ceph-argparseUpgrade python3-rbdUpgrade ceph-immutable-object-cacheUpgrade python3-cephfsUpgrade ceph-fuse-debuginfoUpgrade librados-develUpgrade libcephfs2Upgrade ceph-mgr-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-baseUpgrade ceph-resource-agentsUpgrade python3-rgw-debuginfoUpgrade cephfs-topUpgrade ceph-mibUpgrade ceph-osd-debuginfoUpgrade ceph-debugsourceUpgrade ceph-common-debuginfoUpgrade libradospp-develUpgrade ceph-mon-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-cephfs-debuginfoUpgrade rbd-nbd-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-selinuxUpgrade ceph-base-debuginfoUpgrade ceph-exporter-debuginfoUpgrade libradosstriper1Upgrade ceph-mds-debuginfoUpgrade python3-rbd-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python3-rgwUpgrade cephadm-ansible | Dec 13, 2023 | Jun 6, 2023 |
| Freebsd | — | Upgrade grafanaUpgrade grafana9 | Jun 8, 2023 | Jun 7, 2023 |
| Redhat_linux | — | Upgrade ceph-exporter-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade ceph-base-debuginfoUpgrade python3-ceph-argparseUpgrade rbd-fuse-debuginfoUpgrade cephadm-ansibleUpgrade librgw2Upgrade python3-ceph-commonUpgrade rbd-mirror-debuginfoUpgrade libcephfs2-debuginfoUpgrade python3-rgwUpgrade python3-radosUpgrade python3-cephfs-debuginfoUpgrade librgw-develUpgrade ceph-mgr-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade ceph-mon-debuginfoUpgrade libcephfs2Upgrade librados-develUpgrade python3-cephfsUpgrade rbd-nbd-debuginfoUpgrade ceph-debugsourceUpgrade ceph-common-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-immutable-object-cacheUpgrade librgw2-debuginfoUpgrade libcephsqlite-debuginfoUpgrade ceph-fuseUpgrade ceph-debuginfoUpgrade python3-rados-debuginfoUpgrade python3-rbdUpgrade libradosstriper1-debuginfoUpgrade cephadmUpgrade librbd-develUpgrade libradosstriper1Upgrade ceph-mds-debuginfoUpgrade libradospp-develUpgrade ceph-resource-agentsUpgrade ceph-fuse-debuginfoUpgrade ceph-selinuxUpgrade ceph-baseUpgrade ceph-osd-debuginfoNo solution existsUpgrade librados-devel-debuginfoUpgrade libcephfs-develUpgrade python3-rbd-debuginfoUpgrade ceph-commonUpgrade ceph-mibUpgrade rbd-nbdUpgrade cephfs-mirror-debuginfoUpgrade cephfs-top | Dec 13, 2023 | Jun 6, 2023 |
| Suse | — | Upgrade grafana | Jul 21, 2023 | Jun 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub