CVE-2023-2801 - CVE House
Back to Database
Status published High CVE-2023-2801

Grafana is an open-source platform for monitoring and observability. Using...

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2801

Credits & Attribution

No credits recorded in the NVD database.

References

More from Grafana

View All →
CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium 5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium 4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High 7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High 7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical 9.1

Affected Vendor

Affected Software

Grafana, Grafana Enterprise
Vulnerable Versions:
9.4.0, 9.5.0

Timeline

Official Publish: June 6th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-820

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.