Vulnerability Details : CVE-2023-5122
Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing CSV data from a remote endpoint configured by an administrator. If this plugin was configured to send requests to a bare host with no path (e.g. https://www.example.com/ https://www.example.com/` ), requests to an endpoint other than the one configured by the administrator could be triggered by a specially crafted request from any user, resulting in an SSRF vector. AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2023-5122
- cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-5122
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 22 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-5122
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST | 2024-10-23 |
5.0
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
3.1
|
1.4
|
Grafana Labs | 2024-02-14 |
CWE ids for CVE-2023-5122
-
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.Assigned by:
- nvd@nist.gov (Primary)
- security@grafana.com (Secondary)
References for CVE-2023-5122
-
https://security.netapp.com/advisory/ntap-20240503-0002/
CVE-2023-5122 Grafana Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://grafana.com/security/security-advisories/cve-2023-5122/
404 Page not found | Grafana LabsVendor Advisory
Jump to