VDB
CVE-2022-23498
CVE-2022-23498
PUBLISHED
CVSS 8.800000190734863 HIGH
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
EPSS 1.13% · 64.3th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.13%
64.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | grafana | 8.3.1, 9.3.0 |
| Bitnami | grafana | 8.3.1, 9.3.0 |
Timeline
- Feb 1, 2023 CVE Published
- Feb 4, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 16, 2023 EPSS Score
- Apr 26, 2023 EPSS Score
- Jun 5, 2023 EPSS Score
- Jul 15, 2023 EPSS Score
- Aug 25, 2023 EPSS Score
- Oct 4, 2023 EPSS Score
- Dec 23, 2023 EPSS Score
- Feb 2, 2024 EPSS Score
- Mar 13, 2024 EPSS Score