UpHeron
All vulnerabilities

Servers and applications

CVE-2022-23498

Use of Cache Containing Sensitive Information

Severity
High 8.8
Published
1 Feb 2023
Last changed
3 Nov 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.2.10, 9.3.4
Also known as
GHSA-2j8f-6whh-frc8
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • Version 8.3.0-beta1
  • Version 8.3.0-beta2
  • From 8.3.1 before 9.2.10
  • From 9.3.0 before 9.3.4
GrafanaServers and applications · github:grafana/grafana
  • From 8.3.0-beta1 before 9.2.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23498
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23498
  • GitHub Advisory Database https://github.com/advisories/GHSA-2j8f-6whh-frc8
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8