CVE-2022-23498 — When query caching is enabled in Grafana users can query another users session

Description (CNA)

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.

Affected (CNA)

Vendor / product	Versions
grafana / grafana	affected >= 8.3.0-beta1, < 9.2.10

CWE

CWE-200

References

https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8

ADP enrichment

CVE

No English description supplied.

https://security.netapp.com/advisory/ntap-20230309-0007/
https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8

CISA-ADP

No English description supplied.

No references supplied.