CVE-2023-4457 - CVE House
Back to Database
Status published Medium CVE-2023-4457

Grafana is an open-source platform for monitoring and observability. The Google...

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, making it potentially expose the Google Sheet API-key that is configured for the data source. This vulnerability was fixed in version 1.2.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4457

Credits & Attribution

No credits recorded in the NVD database.

References

More from Grafana

View All →
CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium 5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium 4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High 7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High 7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical 9.1

Affected Vendor

Affected Software

google-sheets-datasource
Vulnerable Versions:
0.9.0

Timeline

Official Publish: October 16th, 2023
Last Modified: September 16th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-209

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information
Reconnaissance
T1083 File and Directory Discovery
Discovery
T1552 Unsecured Credentials
Credential Access
T1212 Exploitation for Defense Evasion
Defense Evasion
T1005 Data from Local System
Collection