CVE-2022-23498: When query caching is enabled in Grafana users can query another users session
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including grafanasession. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-23498?
CVE-2022-23498 is a vulnerability in Grafana that allows a user to acquire another user's session by exploiting the caching of headers, including the 'grafana_session' header, in datasource queries.
How severe is CVE-2022-23498?
CVE-2022-23498 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2022-23498?
CVE-2022-23498 affects Grafana versions 8.3.1 to 9.2.10, 9.3.0 to 9.3.4, 8.3.0-beta1, and 8.3.0-beta2.
How can I mitigate CVE-2022-23498?
To mitigate CVE-2022-23498, disable datasource query caching in Grafana or upgrade to a patched version.
Where can I find more information about CVE-2022-23498?
More information about CVE-2022-23498 can be found at the following link: [GitHub Advisory](https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8).