CVE-2023-2801: grafana Missing Synchronization
Vulnerability summary
CVE-2023-2801 is a high (CVSS 7.5) Missing Synchronization vulnerability in grafana. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 9Timeline
- 06-06-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.74% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-820Missing SynchronizationThe product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
- CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Grafana2 products
- grafana≥ 9.4.0, < 9.4.12 | ≥ 9.5.0, < 9.5.3
- grafana enterprise≥ 9.4.0, < 9.4.12 | ≥ 9.5.0, < 9.5.3
Github.com/grafana1 product
- grafana< 9.4.12 | ≥ 9.5.0, < 9.5.3
Ubuntu1 product
- grafanaAll versions (No fix recorded)
3 vendors · 4 products
References
8 links
- github.com/grafana/grafanaPACKAGE