CVE-2023-2801

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

• CWE-820
• CWE-662

• https://grafana.com/security/security-advisories/cve-2023-2801/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230706-0002/
• https://grafana.com/security/security-advisories/cve-2023-2801/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230706-0002/

Published

Jun 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28003 A CWE-613: Insufficient Session Expiration vulnerability …8.8
• CVE-2023-28004 A CWE-129: Improper validation of an array index vulnerab…9.8
• CVE-2023-28005A vulnerability in Trend Micro Endpoint Encryption Full Disk…6.8
• CVE-2023-28006The OSD Bare Metal Server uses a cryptographic algorithm tha…7.8
• CVE-2023-28008HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to…8.1
• CVE-2023-28009HCL Workload Automation is vulnerable to an XML External Ent…8.1
• CVE-2023-28010In some configuration scenarios, the Domino server host name…5.3
• CVE-2023-28012HCL BigFix Mobile is vulnerable to a command injection attac…8.8
• CVE-2023-28013HCL Verse is susceptible to a Reflected Cross Site Scripting…6.1
• CVE-2023-28014HCL BigFix Mobile is vulnerable to a cross-site scripting at…5.4
• CVE-2023-28015The HCL Domino AppDev Pack IAM service is susceptible to a U…5.3
• CVE-2023-28016Host Header Injection vulnerability in the HCL BigFix OSD Ba…6.1