What is CVE-2022-23498?

CVE-2022-23498 is a high-severity vulnerability in Grafana, classified under Information Disclosure. CVSS score: 7.1/10. Published 2023-02-03.

How severe is CVE-2022-23498?

High severity. CVSS v3 base score is 7.1 out of 10.

Is CVE-2022-23498 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Grafana

CVE-2022-23498

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.

Vulnerability class: Information Disclosure

EPSS: 0.011 (63.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L.

Affected products

Grafana — versions 8.3.0, >= 8.3.0-beta1, < 9.2.10

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory, Mitigation)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2022-23498?: CVE-2022-23498 is a high-severity vulnerability in Grafana, classified under Information Disclosure. CVSS score: 7.1/10. Published 2023-02-03.
How severe is CVE-2022-23498?: High severity. CVSS v3 base score is 7.1 out of 10.
Is CVE-2022-23498 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.