VDB
CVE-2022-23498
CVE-2022-23498
PUBLISHED
CVSS 8.800000190734863 HIGH
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
EPSS 1.13% · 66.1th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.13%
66.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 8.3.1, 9.3.0 |
| Bitnami | grafana | 8.3.1, 9.3.0 |
Timeline
- Feb 1, 2023 CVE Published
- Feb 4, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 17, 2023 EPSS Score
- Apr 27, 2023 EPSS Score
- Jun 6, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Aug 27, 2023 EPSS Score
- Oct 7, 2023 EPSS Score
- Dec 27, 2023 EPSS Score
- Feb 6, 2024 EPSS Score
- Mar 18, 2024 EPSS Score