CVE-2022-23498: When query caching is enabled in Grafana users can query another users session
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 9.3.4 - Upgrade
Upgrade
redhat/grafanato a version that resolves this vulnerability.Fixed in 9.2.10 - Upgrade
Upgrade
grafana/grafanato a version that resolves this vulnerability.Fixed in 9.2.10 - Upgrade
Upgrade
grafana/grafanato a version that resolves this vulnerability.Fixed in 9.3.4 - Configuration
Disable datasource query caching for all datasources.
Grafana datasource query caching datasource query caching = disabled
Event History
Frequently Asked Questions
What is CVE-2022-23498?
CVE-2022-23498 is a vulnerability in Grafana that allows a user to acquire another user's session by exploiting the caching of headers, including the 'grafana_session' header, in datasource queries.
How severe is CVE-2022-23498?
CVE-2022-23498 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2022-23498?
CVE-2022-23498 affects Grafana versions 8.3.1 to 9.2.10, 9.3.0 to 9.3.4, 8.3.0-beta1, and 8.3.0-beta2.
How can I mitigate CVE-2022-23498?
To mitigate CVE-2022-23498, disable datasource query caching in Grafana or upgrade to a patched version.
Where can I find more information about CVE-2022-23498?
More information about CVE-2022-23498 can be found at the following link: [GitHub Advisory](https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8).