CVE-2023-2801

MEDIUM Year: 2023
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-820
View all →

Vulnerability Description

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

Related Vulnerabilities

CVE-2023-45084

MEDIUM
CVSS:6.1(Medium)

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives d...

CWE-8202023

CVE-2024-30387

HIGH
CVSS:6.5(Medium)

A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Servi...

CWE-8202024

CVE-2025-47154

CRITICAL
CVSS:9.0(Critical)

LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrary code via a crafted...

CWE-8202025

CVE-2024-49114

HIGH
CVSS:7.8(High)

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

CWE-8202024

CVE-2025-1445

HIGH
CVSS:7.5(High)

A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations...

CWE-8202025

CVE-2024-30387

HIGH
CVSS:6.5(Medium)

A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an unauthenticated, adjacent attacker to cause a Denial-of-Servi...

CWE-8202024