CVE-2023-5122: SSRF in CSV Datasource Plugin
Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g. https://www.example.com/ https://www.example.com/ ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5122?
CVE-2023-5122 is rated as a medium severity vulnerability.
How do I fix CVE-2023-5122?
To fix CVE-2023-5122, upgrade the Grafana CSV datasource plugin to version 0.6.13 or later.
What impact does CVE-2023-5122 have on Grafana?
CVE-2023-5122 allows an attacker to exploit a vulnerable CSV datasource plugin, potentially leading to data exposure.
Which versions of Grafana are affected by CVE-2023-5122?
CVE-2023-5122 affects Grafana versions prior to 0.6.13 when using the CSV datasource plugin.
Is there a workaround for CVE-2023-5122?
Disabling the CSV datasource plugin is a temporary workaround for CVE-2023-5122 until an upgrade can be performed.