Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

According to its self-reported version, the Grafana install hosted on the remote host is earlier than 8.5.26, or earlier than 9.2.19, or earlier than 9.3.15, or earlier than 9.4.12, or 9.5.x earlier than 9.5.3. It is, therefore, affected by multiple vulnerabilities:

- A Missing Authorization vulnerability.

- A Missing Synchronization vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Grafana is an open-source platform for monitoring and observability. Using public dashboards users can     query multiple distinct data sources using mixed queries. However such query has a possibility of crashing     a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's     also possible to cause this by calling the query API directly. This might enable malicious users to crash     Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
    (CVE-2023-2801)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Grafana is an open-source platform for monitoring and observability. Using public dashboards users can
    query multiple distinct data sources using mixed queries. However such query has a possibility of crashing
    a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's
    also possible to cause this by calling the query API directly. This might enable malicious users to crash
    Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
    (CVE-2023-2801)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7740 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2917-1 advisory.

    grafana:

    - Update to version 9.5.5:
      * CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
      * Bug fixes:
        * Auth: Show invite button if disable login form is set to false.
        * Azure: Fix Kusto auto-completion for Azure datasources.
        * RBAC: Remove legacy AC editor and admin role on new dashboard route.
        * API: Revert allowing editors to access GET /datasources.
        * Settings: Add ability to override skip_org_role_sync with Env variables.
    - Update to version 9.5.3:
      * CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099)
      * CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates     (bsc#1212100)
    - Update to version 9.5.2:
        Alerting: Scheduler use rule fingerprint instead of version.
        Explore: Update table min height.
        DataLinks: Encoded URL fixed.
        TimeSeries: Fix leading null-fill for missing intervals.
        Dashboard: Revert fixed header shown on mobile devices in the new panel header.
        PostgreSQL: Fix TLS certificate issue by downgrading lib/pq.
        Provisioning: Fix provisioning issues with legacy alerting and data source permissions.
        Alerting: Fix misleading status code in provisioning API.
        Loki: Fix log samples using `instant` queries.
        Panel Header: Implement new Panel Header on Angular Panels.
        Azure Monitor: Fix bug that was not showing resources for certain locations.
        Alerting: Fix panic when reparenting receivers to groups following an attempted rename via     Provisioning.
        Cloudwatch Logs: Clarify Cloudwatch Logs Limits.
    - Update to 9.5.1         Loki Variable Query Editor: Fix bug when the query is updated         Expressions: Fix expression load with legacy UID -100

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 652064ef-056f-11ee-8e16-6c3be5272acd advisory.

  - Grafana is an open-source platform for monitoring and observability. Using public dashboards users can     query multiple distinct data sources using mixed queries. However such query has a possibility of crashing     a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's     also possible to cause this by calling the query API directly. This might enable malicious users to crash     Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
    (CVE-2023-2801)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114854	Grafana 9.5.x < 9.5.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114853	Grafana < 9.4.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114852	Grafana < 9.3.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114851	Grafana < 9.2.19 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
114850	Grafana < 8.5.26 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
226522	Linux Distros Unpatched Vulnerability : CVE-2023-2801	Nessus	Misc.	medium
420231	SCA: security update for github.com/grafana/grafana (GHSA-x2w4-c67p-g44j)	Tenable Cloud Security	SCA Checks	medium
420231	SCA: security update for github.com/grafana/grafana (GHSA-x2w4-c67p-g44j)	Tenable Self-Hosted Container Security	SCA Checks	medium
186760	RHEL 9 : Red Hat Ceph Storage 6.1 (RHSA-2023:7740)	Nessus	Red Hat Local Security Checks	medium
178694	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2917-1)	Nessus	SuSE Local Security Checks	critical
176942	FreeBSD : Grafana -- Grafana DS proxy race condition (652064ef-056f-11ee-8e16-6c3be5272acd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-2801

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium